Antivirus Exclusion List for Easy2PatchV4
Easy2Patch 4.0
Easy2Patch downloads third-party vendor installers, builds deployment packages and delivers them to endpoints through Microsoft Configuration Manager, WSUS or Intune. Antivirus and endpoint protection products sometimes interfere with these operations.
This article documents the folders, processes and operations that Easy2Patch uses, so that your security team has the information needed to review them against your own policies. It is reference material for planning, not a configuration requirement.
Please note
Antivirus exclusions reduce the coverage of your security controls. Whether to configure any of the items listed here, and at what scope, is a decision for your organization, to be taken in line with your internal security policy and the guidance of your antivirus vendor. Easy2Patch operates without exclusions in many environments; exclusions are normally considered only where a security product is observed to interfere with a specific operation. Responsibility for evaluating, applying and reviewing any exclusion rests with the organization that configures it.
Unlike Easy2Patch v3, which ran on a single machine, v4 is a server product, so the relevant paths are spread across several systems.
Systems involved
Easy2Patch web server
Downloads vendor installers, extracts the catalog, signs scripts, builds packages
ConfigMgr content share
Stores the published application content
WSUS server
Stores locally published updates
SQL Server
Hosts the Easy2Patch database
Managed endpoints
Run the Easy2Patch detection scripts and installation components
1. Easy2Patch web server
1.1 Application folders
These folders are read and written continuously during normal operation. Where an exclusion is considered, it is normally applied recursively.
%ProgramFiles%\Easy2Patch Web Edition
Application root (default installation path)
%ProgramFiles%\Easy2Patch Web Edition\Logs
Application logs: E2PApi.log, E2PApplication.log, E2PIntuneApplication.log, E2PUpdate.log, E2PEFLog.log, E2PDefender.log, E2PNone.log and rotated *.lo_ files
%ProgramFiles%\Easy2Patch Web Edition\Resources
E2PDTTool.exe, E2PUI.exe
%ProgramFiles%\Easy2Patch Web Edition\FTW
Setup wizard and database scripts
%ProgramFiles%\Easy2Patch Web Edition\ConfigMgr
ConfigMgr/WSUS agent sub-application
%ProgramFiles%\Easy2Patch Web Edition\wwwroot
Management console (web assets)
1.2 Download and staging folders
The download root is configured in Settings → General → Path. By default it is the root of the first fixed drive on the server. Replace <DownloadDrive> below with the drive letter configured in your installation.
<DownloadDrive>\Download
Downloaded catalog archive
<DownloadDrive>\Download\Extract
Extracted catalog metadata
<DownloadDrive>\Download\Deployment
Deployment working folder
<DownloadDrive>\Download\Deployment\Publish
Published package content
<DownloadDrive>\Download\Deployment\Publish\V2
Update metadata (*.sdp)
<DownloadDrive>\Download\Temporary
Downloaded vendor installers, one subfolder per package
<DownloadDrive>\Download covers all of the above.
Every installer Easy2Patch publishes passes through Download\Temporary, where its digest is verified against the catalog. If a security product locks or quarantines a file during this stage, the digest check fails and the publish operation reports a download error rather than a virus detection. This is the most common reason for unexplained publish failures.
1.3 Temporary folders
Easy2Patch also writes to the temporary folder of the IIS application pool identity.
%TEMP%\E2P-Extract
Catalog extraction
%TEMP%\dtScriptTemplate.ps1
Detection script, created and signed during publishing
%TEMP%\tempSignSicript.ps1
Signing working file
%TEMP%\E2P-SelfSignedCert
WSUS code-signing certificate generation
%TEMP%\<GUID>
Intune package (.intunewin) creation
%TEMP% resolves according to the application pool identity:
Application pool identity without a loaded user profile, LocalSystem, NetworkService
%SystemRoot%\Temp
Application pool with Load User Profile enabled
%SystemDrive%\Users\<identity>\AppData\Local\Temp
Dedicated domain service account
%SystemDrive%\Users\<account>\AppData\Local\Temp
Determine which applies to your installation. Only the Easy2Patch subfolders listed above are involved; the temporary folder as a whole is not.
1.4 IIS and .NET folders
These are standard IIS hosting locations, listed because the ConfigMgr agent sub-application compiles into them.
%SystemDrive%\inetpub\temp
%SystemDrive%\inetpub\logs
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files
1.5 Processes
IIS worker process
%SystemRoot%\System32\inetsrv\w3wp.exe
.NET host
%ProgramFiles%\dotnet\dotnet.exe
Easy2Patch host
%ProgramFiles%\Easy2Patch Web Edition\Easy2Patch.ClientUIWebPortal.exe
Setup wizard
%ProgramFiles%\Easy2Patch Web Edition\FTW\FTW.exe
Code-signing tool
%ProgramFiles%\Easy2Patch Web Edition\signtool.exe
Script runner
%ProgramFiles%\Easy2Patch Web Edition\Resources\E2PDTTool.exe
Notification component
%ProgramFiles%\Easy2Patch Web Edition\Resources\E2PUI.exe
w3wp.exe hosts all IIS applications on the server, not only Easy2Patch. If your antivirus product supports scoping process rules to a specific application pool, restricting them to the Easy2Patch and ConfigMgr application pools keeps the scope narrower.
1.6 Integrity verification
Before each publish operation, Easy2Patch verifies the SHA-256 hash of signtool.exe, E2PDTTool.exe and E2PUI.exe, and verifies E2PDTTool.exe and E2PUI.exe again after they are copied to the content share. If a security product quarantines or modifies any of these files, the publish operation stops with a hash mismatch error rather than continuing with an altered file.
2. ConfigMgr content share
Application content is written to the UNC path configured in Settings → Application Deployment → Content Folder, using the following structure:
This path is relevant on the file server that hosts the share.
Microsoft's standard Configuration Manager antivirus guidance applies to the site server and distribution points independently of Easy2Patch.
3. WSUS server
%ProgramFiles%\Update Services
The WsusContent folder on the volume where it is located
4. SQL Server
The instance hosting the Easy2Patch database is covered by Microsoft's standard SQL Server antivirus guidance (*.mdf, *.ldf, *.ndf, backup folders, sqlservr.exe). The Easy2Patch database stores catalog content and background job state and is written to continuously.
5. Managed endpoints
Two Easy2Patch components run on managed endpoints: E2PDTTool.exe, which performs installation and uninstallation, and E2PUI.exe, which displays end-user notifications. In addition, the deployment platform writes the Easy2Patch detection and requirement scripts to its system temporary folder and executes them from there.
5.1 Folders
%SystemRoot%\ccmcache
ConfigMgr content: vendor installer, E2PDTTool.exe, E2PUI.exe, appInfo.txt, msi.log
%SystemRoot%\CCM\SystemTemp
Detection and requirement scripts executed in system context
%SystemRoot%\CCM\ScriptStore
Cached deployment scripts
%ProgramData%\Microsoft\IntuneManagementExtension\Content\Incoming
Intune package as delivered
%ProgramData%\Microsoft\IntuneManagementExtension\Content\Staging
Intune package after extraction
%ProgramData%\Microsoft\IntuneManagementExtension\Policies\Scripts
Intune detection and requirement scripts
%SystemRoot%\Temp\E2P
E2PDTTool.exe log files, one per package, when running in system context
%TEMP%\E2P
E2PDTTool.exe log files when running in user context
%ProgramData%\Easy2PatchLog
Detection script log E2PLogs.log and its rotated copy E2PLogs.lo_, written in system context
%TEMP%\E2PLogs.log
Detection script log when the script runs in user context
Only the E2P subfolder of %SystemRoot%\Temp is involved, not the folder as a whole.
5.2 Processes
Installation runner
E2PDTTool.exe
End-user notification
E2PUI.exe
Windows PowerShell (64-bit)
%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe
Windows PowerShell (32-bit)
%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Both PowerShell hosts are involved: the Easy2Patch detection script performs a separate 32-bit pass in order to read the WOW6432Node uninstall registry hive. Where your antivirus product allows it, rules can be scoped to scripts executed from the ConfigMgr or Intune script folders listed in section 5.1, which is narrower than addressing powershell.exe as a whole.
E2PDTTool.exe starts msiexec.exe and cmd.exe during installation and uninstallation, and runs under the Configuration Manager client (CcmExec.exe). These are shared Windows and Configuration Manager components used by all software deployment on the machine, so addressing the content folders in section 5.1 is more precise than addressing those processes.
5.3 Behavioral detections
Folder and process rules do not affect behavior-based detection. The following operations are part of normal Easy2Patch installation behavior and may be reported by endpoint detection and response products. If they are, they are typically handled with a behavioral allow rule or a file-hash indicator rather than a folder exclusion.
Writing a Debugger value under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<application>.exe, in both the 32-bit and 64-bit registry views
Prevents the user from restarting the application while it is being updated. The value points to E2PUI.exe, which displays an update-in-progress message, and is removed once installation completes. Corresponds to MITRE ATT&CK technique T1546.012
Terminating running applications listed in the package's process conflict list
Releases file locks so the installation can proceed. T1562.001
Running the application's registered uninstall command through cmd.exe from the content folder
Standard uninstall path for EXE-based applications. T1059.003
Enumerating all subkeys of HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall in both registry views
Detects the installed version of the target application. T1518
Where registry rules are supported, scoping the Image File Execution Options entry to writes performed by E2PDTTool.exe is narrower than addressing the registry key itself.
5.4 Microsoft Defender attack surface reduction rules
The following ASR rules can block third-party application deployment. Microsoft supports per-rule exclusions, which allow the ConfigMgr content share and the ConfigMgr cache to be addressed without turning the rule off.
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
Use advanced protection against ransomware
Block process creations originating from PSExec and WMI commands
6. File types
Within the folders listed in sections 1.2, 2 and 5.1, the following file types occur during normal operation:
.exe · .msi · .msp · .msu · .zip · .cab · .sdp · .intunewin · .ps1 · .txt · .json
These are common file types found throughout Windows. Any rule based on them is far more precise when scoped to the folders above than when applied globally.
7. Network access
Where a web filtering, TLS inspection or egress proxy layer is in place, the Easy2Patch server requires access to:
https://license.arksoft.com.tr
Licensing and catalog download
https://graph.microsoft.com
Intune application management and Entra ID
https://login.microsoftonline.com
Authentication
https://api.securitycenter.microsoft.com
Microsoft Defender for Endpoint vulnerability data
Configured timestamp server (default http://timestamp.digicert.com)
Code signing
https://picblobstorage.blob.core.windows.net/*
Installer downloads
Vendor download URLs are supplied by the catalog and change with each catalog release, so a fixed list is not possible. Outbound HTTPS access from the Easy2Patch server, or a proxy configured under Settings → Proxy with the allow list maintained at the proxy, are the two usual approaches.
Internal ports used: SQL Server 1433, WSUS 8530 / 8531, LDAP 389 / 636, SMTP 587, and DCOM/WMI (135 plus the dynamic RPC range) to the ConfigMgr SMS Provider.
8. Scope guidance
Where an exclusion is applied, keeping it as narrow as possible limits its effect on your overall protection. The following are broader than anything described in this article:
The entire system drive or the %ProgramFiles% tree
The specific folders in section 1.1
%SystemRoot%\Temp in full
%SystemRoot%\Temp\E2P and the subfolders in section 1.3
*.exe or *.ps1 as global file type rules
The same file types scoped to the folders in section 6
msiexec.exe, cmd.exe, rundll32.exe, CcmExec.exe
The content folders in section 5.1
powershell.exe across the endpoint estate
Scripts executed from the ConfigMgr or Intune script folders
The Image File Execution Options registry key
Writes performed by E2PDTTool.exe
Reviewing any applied exclusion periodically, and removing it once it is no longer needed, is good practice.
9. Troubleshooting
Publish fails with a download error, but the URL is reachable
The installer is being scanned or quarantined in Download\Temporary. See section 1.2
Publish fails with a hash mismatch for E2PDTTool.exe or E2PUI.exe
The file has been modified or quarantined on the content share. See section 2
Publish fails during script signing
The temporary folder in use does not match the application pool identity. See section 1.3
Deployment reports success but the application is not installed
An ASR rule is blocking the installer. See section 5.4
The target application cannot be started after a failed deployment
The Image File Execution Options entry was not removed. See section 5.3
Deployments fail on protected endpoints with no antivirus detection recorded
Check the endpoint detection and response behavior log against section 5.3
Endpoint deployment failures are recorded in %SystemRoot%\CCM\Logs\AppEnforce.log and AppDiscovery.log, and in the Easy2Patch logs under %SystemRoot%\Temp\E2P and %ProgramData%\Easy2PatchLog.
10. About the Easy2Patch components
E2PDTTool.exe, E2PUI.exe and signtool.exe are digitally signed, and their hashes are verified by the application before every publish operation. The vendor installers Easy2Patch distributes are downloaded over HTTPS and verified against the digest published in the Easy2Patch catalog.
If a security product reports a detection on an Easy2Patch component, please contact Easy2Patch support with the detection details so that the file can be verified and, where appropriate, submitted to the vendor for review.
Last updated