Extension Exclusions for Sage

[patrfamilias]

Hello,

Sage has always suggested excluding a list of proprietary file extensions from their real time threat protection when using their MAS product.

I am unable to add an extension to the ignore list in MBAM.  Ex:  *.m4t  Do you have any suggestions on accomplishing this?  The purpose is for performance.

Thanks,

Patr

[djacobson]

Hi @patrfamilias. Are you using MBEP - Endpoint Protection, or MBMC - Malwarebytes Management Console?

[patrfamilias]

I'm trying to make the change in MBMC...  The product it pushes out is MBEP (MBAM and MBAE,) right?

thanks,

Patr

[djacobson]

No, these are separate products. MBMC is hosted on your own server and installs legacy MBAM (1.80) and MBAE (1.10). MBEP runs from a SaaS web portal and deploys our next-gen MB3, modified for use on business systems. Depending on which one you have, the approach will be different, and only MBEP supports exclusions via file extension directly.

[patrfamilias]

I'll be damned...  OK, well I'm using MBMC.

[djacobson]

What's the full path to the file?

[patrfamilias]

 D:\ACCT\

[djacobson]

Is that a drive share for these machines?

[patrfamilias]

It is a share, yes.

[djacobson]

That may be a problem, drive shares and UNC paths are not supported in MBMC's ignore list and there are known issues with the MBAM version in this product, its realtime function and applications that run from or write to drive shares. We have two workarounds for that, though success with them varies. 

First workaround is if the server hosting the share is DFS type, you can change the Access Based Enumeration (ABE) settings on the server hosting the share or application that runs from the share. As a test, you can you see if disabling ABE can help with the issue. To disable access-based enumeration using the Windows interface:

In the console tree, under the Namespaces node, right-click the appropriate namespace and then click Properties.

Click the Advanced tab and then uncheck the "Enable access-based enumeration" for this namespace check box.

Screenshot attached and you may also follow this link for more info - https://msdn.microsoft.com/en-us/library/dd759150.aspx

 

Option 2 is to create a new group in AD, assign some of the Computers which have the problem to that group. Add that group to the drive shares, giving the group full access over the share. If this works, assign all Computers needed in AD to the group.   

Edited January 4, 2018 by djacobson
grammar