UPDATE: Please note that this topic has been moved to Citrix Tech Zone, so this post will not be updated any longer. For up-to-date recommendations on Antivirus exclusions, please refer to the Endpoint Security, Antivirus and Antimalware Best Practices tech paper.

********************************************************************************

There are lots of Citrix support articles and blog posts out there with information on recommended antivirus exclusions for Citrix products, all of which have been extremely helpful over the years. But let’s face it, it is a little annoying to have to gather information from multiple product-specific posts/articles to get all configurations that apply to your virtualization solution.

The introduction of the “Current Release” Servicing Option this year (2016) and resulting frequent product release cycles, in particular, has made it, to say the least, challenging to maintain content that recommends whitelisting all Citrix services against an ever-changing set of product services. So, my goal here is to provide you with a consolidated list of recommended antivirus exclusions for your Citrix virtualization environment focused on the key processes, folders, and files that we have seen cause issues in the field (and for the most part tend to remain consistent across releases, no guarantees though), rather than identifying every single Citrix process, folder, and file for each product.

Before we continue… WARNING! While we generally feel these configurations and exclusions provide the best balance between security and performance, please don’t forget that antivirus exclusions increase the attack surface of a system and might expose it to real security threats. Citrix does NOT recommend implementing any of these settings in production without first discussing them with your organization’s security teams and thoroughly testing and validating them in a test environment.

Now, just because files and folders are excluded from real-time and/or on-access scans, it doesn’t mean they should never be scanned. Scheduled full-system scans for your infrastructure servers (and any persistent machines) should still be performed to ensure everything in the system is safe, but it should be done during non-business or off-peak hours to mitigate any performance impact as much as possible.

One more thing before we get into the recommendations: the exclusions recommended include folders, files, and processes. Folder and file exclusions are pretty straight forward; we don’t want those files or folders to be scanned when accessed or modified. When it comes to processes, however, there is typically some confusion about what the goal is. When excluding processes, what we want is to prevent any reads and writes done by those processes from being scanned; not necessarily to prevent the exe file from being scanned. In some antivirus solutions, this is referred to as defining trusted processes.

The following recommendations apply to all Citrix components:

  • Set real-time scanning to scan local drives only and not network drives
  • Disable scan on boot
  • Remove any unnecessary antivirus related entries from the Run key
  • Exclude the pagefile(s) from being scanned
  • Exclude Windows event logs from being scanned
  • Exclude IIS log files from being scanned

The following are the recommendations specific to each component:

StoreFront
2.0 – 2.5
Files:
  • %ProgramFiles%\Citrix\Receiver StoreFront\Services\SubscriptionsStoreService
    \**\PersistentDictionary.edb

Processes:

  • %ProgramFiles%\Citrix\Receiver StoreFront\Services\SubscriptionsStoreService
    \Citrix.DeliveryServices.ServiceHosting.WindowsServiceHost.exe
  • %ProgramFiles%\Citrix\Receiver StoreFront\Services\CredentialWallet
    \Citrix.DeliveryServices.CredentialWallet.ServiceHost.exe
StoreFront
2.6 – 3.x
Files:
  • %SystemRoot%\ServiceProfiles\NetworkService\AppData\Roaming
    \Citrix\SubscriptionsStore\**\PersistentDictionary.edb

Processes:

  • %ProgramFiles%\Citrix\Receiver StoreFront\Services\SubscriptionsStoreService
    \Citrix.DeliveryServices.SubscriptionsStore.ServiceHost.exe
  • %ProgramFiles%\Citrix\Receiver StoreFront\Services\CredentialWallet
    \Citrix.DeliveryServices.CredentialWallet.ServiceHost.exe
PVS Server Files:
  • **\*.vhd
  • **\*.avhd
  • **\*.vhdx
  • **\*.avhdx
  • %SystemRoot%\System32\drivers\CvhdBusP6.sys (Windows Server 2008 R2)
  • %SystemRoot%\System32\drivers\CVhdMp.sys (Windows Server 2012 R2)
  • %SystemRoot%\System32\drivers\CfsDep2.sys
  • %ProgramData%\Citrix\Provisioning Services\Tftpboot\ARDBP32.BIN

Processes:

  • %ProgramFiles%\Citrix\Provisioning Services\BNTFTP.EXE
  • %ProgramFiles%\Citrix\Provisioning Services\PVSTSB.EXE
  • %ProgramFiles%\Citrix\Provisioning Services\StreamService.exe
  • %ProgramFiles%\Citrix\Provisioning Services\StreamProcess.exe
  • %ProgramFiles%\Citrix\Provisioning Services\soapserver.exe
PVS Target Device Files:
  • **\*.vdiskcache
  • **\vdiskdif.vhdx (7.x only)
  • %SystemRoot%\System32\drivers\bnistack6.sys
  • %SystemRoot%\System32\drivers\CfsDep2.sys
  • %SystemRoot%\System32\drivers\CVhdBusP6.sys
  • %SystemRoot%\System32\drivers\CVhdMp.sys (7.x only)

Processes:

  • %ProgramFiles%\Citrix\PvsVm\Service\PvsVmAgent.exe
  • %ProgramFiles%\Citrix\Personal vDisk\BIN\CTXPVD.exe (PvD and AppDisks only)
  • %ProgramFiles%\Citrix\Personal vDisk\BIN\CTXPVDSVC.exe (PvD and AppDisks only)
XenApp / XenDesktop 7.x Controller Files:
  • %systemroot%\ServiceProfiles\NetworkService\HaDatabaseName.mdf (7.12+)
  • %systemroot%\ServiceProfiles\NetworkService\HaImportDatabaseName.mdf (7.12+)
  • %systemroot%\ServiceProfiles\NetworkService\HaDatabaseName_log.ldf (7.12+)
  • %systemroot%\ServiceProfiles\NetworkService\HaImportDatabaseName_log.ldf (7.12+)

Folders:

  • %programdata%\Citrix\Broker\Cache (7.6+)

Processes:

  • %ProgramFiles%\Citrix\Broker\Service\BrokerService.exe
  • %ProgramFiles%\Citrix\Broker\Service\HighAvailabilityService.exe (7.12+)
  • %ProgramFiles%\Citrix\ConfigSync\ConfigSyncService.exe (7.12+)
Cloud Connector Files:
  • %systemroot%\ServiceProfiles\NetworkService\HaDatabaseName.mdf
  • %systemroot%\ServiceProfiles\NetworkService\HaImportDatabaseName.mdf
  • %systemroot%\ServiceProfiles\NetworkService\HaDatabaseName_log.ldf
  • %systemroot%\ServiceProfiles\NetworkService\HaImportDatabaseName_log.ldf

Folders:

  • %systemdrive%\Logs\CDF
  • %programdata%\Citrix\WorkspaceCloud\Logs

Processes:

  • %ProgramFiles%\Citrix\XaXdCloudProxy\XaXdCloudProxy.exe
  • %ProgramFiles%\Citrix\Broker\Service\HighAvailabilityService.exe
  • %ProgramFiles%\Citrix\ConfigSync\ConfigSyncService.exe
XenApp / XenDesktop 7.x Server OS VDA Files:
  • %userprofile%\AppData\Local\Temp\Citrix\HDXRTConnector\*\*.txt

Processes:

  • %ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe
  • %ProgramFiles%\Citrix\Virtual Desktop Agent\BrokerAgent.exe
  • %ProgramFiles%\Citrix\Personal vDisk\BIN\CTXPVD.exe (AppDisks only)
  • %ProgramFiles%\Citrix\Personal vDisk\BIN\CTXPVDSVC.exe (AppDisks only)
  • %SystemRoot%\System32\spoolsv.exe
  • %SystemRoot%\System32\winlogon.exe
XenDesktop 7.x Client OS VDA Files:
  • %userprofile%\AppData\Local\Temp\Citrix\HDXRTConnector\*\*.txt

Processes:

  • %ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe
  • %ProgramFiles%\Citrix\Virtual Desktop Agent\BrokerAgent.exe
  • %ProgramFiles%\Citrix\ICAService\picaSvc2.exe
  • %ProgramFiles%\Citrix\ICAService\CpSvc.exe
  • %ProgramFiles%\Citrix\Personal vDisk\BIN\CTXPVD.exe (PvD and AppDisks only)
  • %ProgramFiles%\Citrix\Personal vDisk\BIN\CTXPVDSVC.exe (PvD and AppDisks only)
  • %SystemRoot%\System32\spoolsv.exe
  • %SystemRoot%\System32\winlogon.exe
XenApp 6.5 Files:
  • %ProgramFiles(x86)%\Citrix\Independent Management Architecture\RadeOffline.mdb
  • %ProgramFiles(x86)%\Citrix\Independent Management Architecture\imalhc.mdb
  • %ProgramFiles(x86)%\Citrix\Citrix Resource Manager\LocalDB\RMLocalDatabase.mdb

Processes:

  • %ProgramFiles%\Citrix\User Profile Manager\UserProfileManager.exe
  • %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\ImaSrv.exe
  • %ProgramFiles(x86)%\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe
Workspace Environment Management Infrastructure Service Processes:
  • Norskale Broker Service.exe
  • Norskale Broker Service Configuration Utility.exe
  • Norskale Database Management Utility.exe
Workspace Environment Management Agent Processes:
  • Agent Log Parser.exe
  • AgentCacheUtility.exe
  • AppsMgmtUtil.exe
  • Norskale Agent Host Service.exe
  • PrnsMgmtUtil.exe
  • VUEMAppCmd.exe
  • VUEMAppCmdDbg.exe
  • VUEMAppHide.exe
  • VUEMCmdAgent.exe
  • VUEMMaintMsg.exe
  • VUEMRSAV.exe
  • VUEMUIAgent.exe
EdgeSight Agent Folders:
  • %AllUsersProfile%\Application Data\Citrix\System Monitoring\Data

Processes:

  • %ProgramFiles%\Citrix\System Monitoring\Agent\Core\rscorsvc.exe
  • %ProgramFiles%\Citrix\System Monitoring\Agent\Core\Firebird\bin\fbserver.exe
EdgeSight Server Folders:
  • %CommonProgramFiles(x86)%\Citrix\System Monitoring\Server\RSSH
  • %ProgramFiles(x86)%\Citrix\System Monitoring\Server\EdgeSight\scripts\rssh
  • %ProgramFiles(x86)%\Citrix\System Monitoring\Server\EdgeSight\Pages
  • %ProgramFiles(x86)%\Microsoft SQL Server\MSSQL\Reporting Services
  • %ProgramFiles%\Microsoft SQL Server\MSSQL\Data
  • %SystemRoot%\SYSTEM32\Logfiles
Receiver for Windows Files:
  • %userprofile%\AppData\Local\Temp\Citrix\RTMediaEngineSRV
    \MediaEngineSRVDebugLogs\*\*.txt

Processes:

  • %programfiles(x86)%\Citrix\ICA Client\MediaEngineService.exe
  • %programfiles(x86)%\Citrix\ICA Client\CDViewer.exe
  • %programfiles(x86)%\Citrix\ICA Client\concentr.exe
  • %programfiles(x86)%\Citrix\ICA Client\wfica32.exe
  • %programfiles(x86)%\Citrix\ICA Client\AuthManager\AuthManSvr.exe
  • %programfiles(x86)%\Citrix\ICA Client\SelfServicePlugin\SelfService.exe
  • %programfiles(x86)%\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe

Please note that these exclusions for Receiver are typically not needed.  We have only seen a need for these in environments where the antivirus is configured with stricter than usual policies or where multiple security agents are in use simultaneously (AV, DLP, HIP, etc.)

In case you feel compelled to look at multiple articles and posts, here are a few references:

Until next time!

Migs

Enterprise Architect | Citrix Consulting

Blog Banners -- FOOTER-2