VMware Carbon Black Cloud Defense 3.6 Settings for Windows File Archiver

VMware Carbon Black Cloud Defense 3.6 can be configured on the computers that have the Windows File Archiver agent installed. It allows for scanning of processes that are running on the servers. By default these processes are scanned in real-time for known viruses as and when the files are being processed for archiving. The "Scanning Phase" of archiving keeps triggering the scanning process of the antivirus, which is very resource intensive.

Exclude Files from Scanning

1. Log on to the VMware Carbon Black Cloud Defense portal.

2. From the navigation menu, go to Enforce > Policies > policy.

   

   The policy details page appears.

3. On the Prevention page, go to permissions, and then click + Add application path.

4. Under Application(s) at path, type the following:

   • software_installation_directory/<ContentStore>/Base

   • GXHSMStub.exe

   • GXHSMService.ex (Ensure that the extension is ‘.EX’)

   • ClMgrS.exe

   • CVD.exe

   • CLRestore.exe

   • CLBackup.exe

   • Ifind.exe

   • cvfwd.exe

   • GXHSMCache dir in the drive where stubs are located

5. In the Performs any operation row, in the ACTION column, select Bypass.

   

Configure Windows Registry

1. Start the Registry Editor on the computer where the file archiver agent is installed.

2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cvmhsm\Parameters\.

3. Right-click Parameters, point at New and click String Value.

4. In the Value Name box type ExcludeProcessX.

   Where X is the next consecutive number in the list (i.e. ExcludeProcess1, ExcludeProcess2, etc.)) for any process that should not initiate recalls.

   All ExcludeProcess names must be truncated to a maximum 15 character string value or the Windows OS Kernel Mode will not process the exclusion properly. This would result in the exclusion being ignored, unexpected recalls occurring and other unexplained stub activities.

   For example:

   Processnamelong (Truncated from Processnamelongerthan15characters.exe to meet 15 character limit)

5. In addition to registry keys with environment specific executables,verify that ExcludeProcess registry is also created for RepMgr.exe.

6. Restart the Commvault services for the registry to take its effect.

7. In a cluster setup repeat all the above mentioned steps on all the physical machines.