List of exclusions needed for a Windows Domain Controller with Active Directory or File Replication Service / Distributed File System Replication:
For compatibility with a Windows Domain Controller with Active Directory or File Replication Service (FRS) / Distributed File System Replication (DFSR):

• Exclude the locations that Microsoft recommends for file-level scanners in the on-access scanner for ENS or VSE.
• For the most accurate list of file exclusions, see the following Microsoft TechNet article: https://social.technet.microsoft.com/wiki/contents/articles/953.microsoft-anti-virus-exclusion-list.aspx. In the TechNet article, go to the "Windows / Active Directory" section. Click the article link for the version of Windows Server that you use in your environment.

How to configure exclusions in ENS or VSE:
When you configure exclusions, always apply the principle that the more precise the exclusion, the smaller the potential security risk. For instructions to configure exclusions, see the following documentation:

• For ENS, see the "Preventing Threat Prevention from blocking trusted programs, networks, and services" section of the Endpoint Security 10.7 Product Guide
• For VSE, see the following:
  • KB66909 - Endpoint Security/VirusScan Enterprise exclusion articles
  • KB55898 - VirusScan Enterprise Exclusions Explained
  • KB67544 - How to create low-risk and high-risk process exclusions for VirusScan Enterprise 8.x in ePolicy Orchestrator
  • KB50998 - How to manage file and folder exclusions using wildcards
  • KB61000 - Path of a scan item reported by its physical address instead of logical address