General recommendations for Windows servers running Citrix components
- Set real-time scanning to scan on write operations only and not on read/access
- Set real-time scanning to scan local drives only and not network drives
- Disable scan on boot
- Remove any unnecessary antivirus related entries from the Run key
- Exclude the pagefile(s) from being scanned
- Exclude IIS log files from being scanned
- Exclude Windows event logs from being scanned
| Citrix Product | Antivirus Exclusions |
|---|---|
| XenApp | Controller: %windir%\system32\csrss.exe %windir%\system32\winlogon.exe %windir%\system32\userinit.exe %windir%\system32\smss.exe %ProgramFiles(x86)%\Citrix\Group Policy\Client-Side Extension\CitrixCseEngine.exe %ProgramFiles(x86)%\Citrix\System32\wfshell.exe %ProgramFiles(x86)%\Citrix\system32\ctxxmlss.exe %ProgramFiles(x86)%\Citrix\System32\CtxSvcHost.exe %ProgramFiles(x86)%\Citrix\system32\mfcom.exe %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\ImaSrv.exe %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe %ProgramFiles(x86)%\Citrix\HealthMon\HCAService.exe %ProgramFiles(x86)%\Citrix\Streaming Client\RadeSvc.exe %ProgramFiles(x86)%\Citrix\Streaming Client\RadeHlprSvc.exe %ProgramFiles(x86)%\Citrix\Independent Management Architecture\RadeOffline.mdb %ProgramFiles(x86)%\Citrix\Independent Management Architecture\imalhc.mdb Session Host: %windir%\system32\spoolsv.exe %windir%\system32\csrss.exe %windir%\system32\winlogon.exe %windir%\system32\userinit.exe %windir%\system32\smss.exe %ProgramFiles%\Citrix\Group Policy\Client-Side Extension\CitrixCseEngine.exe %ProgramFiles(x86)%\Citrix\System32\wfshell.exe %ProgramFiles(x86)%\Citrix\system32\CpSvc.exe %ProgramFiles(x86)%\Citrix\System32\CtxSvcHost.exe %ProgramFiles(x86)%\Citrix\system32\mfcom.exe %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\ImaSrv.exe %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe %ProgramFiles(x86)%\Citrix\HealthMon\HCAService.exe %ProgramFiles(x86)%\Citrix\Streaming Client\RadeSvc.exe %ProgramFiles(x86)%\Citrix\Streaming Client\RadeHlprSvc.exe %ProgramFiles(x86)%\Citrix\XTE\bin\XTE.exe %ProgramFiles(x86)%\Citrix\Independent Management Architecture\RadeOffline.mdb %AppData%\ICAClient\Cache (if using pass-through authentication) |
| XenDesktop | Controller: %windir%\system32\csrss.exe %windir%\system32\winlogon.exe %windir%\system32\userinit.exe %windir%\system32\smss.exe Controller – pre-XenDesktop 7.x: %ProgramFiles%\Citrix\Group Policy\Client-Side Extension\CitrixCseEngine.exe %ProgramFiles(x86)%\Citrix\System32\wfshell.exe %ProgramFiles(x86)%\Citrix\system32\ctxxmlss.exe %ProgramFiles(x86)%\Citrix\System32\CtxSvcHost.exe %ProgramFiles(x86)%\Citrix\system32\mfcom.exe Windows Server OS Machines – XenDesktop 7.x: %windir%\system32\spoolsv.exe %windir%\system32\csrss.exe %windir%\system32\winlogon.exe %windir%\system32\userinit.exe %windir%\system32\smss.exe %ProgramFiles%\Citrix\Group Policy\Client-Side Extension\CitrixCseEngine.exe %ProgramFiles(x86)%\Citrix\System32\wfshell.exe %ProgramFiles(x86)%\Citrix\system32\CpSvc.exe %ProgramFiles(x86)%\Citrix\System32\CtxSvcHost.exe |
| Citrix Director & Storefront | \inetpub\temp\IIS Temporary Compressed Files %windir%\system32\inetsrv\w3wp.exe %windir%\SysWOW64\inetsrv\w3wp.exe StoreFront: %ProgramFiles%\Citrix\Receiver StoreFront\Services\SubscriptionsStoreService |
| Citrix Profile Manager | Agent: Do not scan on open or status-check operations %ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe |
| EdgeSight | Agent: %ALLUSERSPROFILE%\Application Data\Citrix\System Monitoring\Data %ProgramFiles%\Citrix\System Monitoring\Agent\Core\rscorsvc.exe %ProgramFiles%\Citrix\System Monitoring\Agent\Core\Firebird\bin\fbserver.exe Server: %CommonProgramFiles%\Citrix\System Monitoring\Server\RSSH %ProgramFiles%\Citrix\System Monitoring\Server\EdgeSight\scripts\rssh %ProgramFiles%\Citrix\System Monitoring\Server\EdgeSight\Pages %ProgramFiles%\Microsoft SQL Server\MSSQL\Reporting Services %ProgramFiles%\Microsoft SQL Server\MSSQL\Data %SystemRoot%\SYSTEM32\Logfiles |
| Provisioning Services | Server: Exclude scanning of Local vDisk Store %windir%\System32\drivers\CvhdBusP6.sys (Windows Server 2008) %windir%\System32\drivers\CVhdMp.sys (Windows Server 2012) %windir%\System32\drivers\CfsDep2.sys %ProgramFiles%\Citrix\Provisioning Services\BNTFTP.EXE %ProgramData%\Citrix\Provisioning Services\Tftpboot\ARDBP32.BIN %ProgramFiles%\Citrix\Provisioning Services\StreamService.exe %ProgramFiles%\Citrix\Provisioning Services\StreamProcess.exe %ProgramFiles%\Citrix\Provisioning Services\soapserver.exe Target: Exclude scanning of Write Cache %ProgramFiles%\Citrix\Provisioning Services\BNDevice.exe %windir%\System32\drivers\bnistack6.sys %ProgramFiles%\Citrix\Provisioning Services\TargetOSOptimizer.exe %windir%\System32\drivers\CfsDep2.sys %windir%\System32\drivers\CVhdBusP6.sys Target – Personal vDisk: CTXPVD.exe CTXPVDSVC.exe %ProgramFiles%\Citrix\Personal vDisk\BIN\WIN7\ |
| XenClient | Synchronizer: %Program Files%\Citrix\Synchronizer |
| Citrix Product | Antivirus Exclusions |
Join the conversation