Forum Discussion

AlanPBourke's avatar
AlanPBourke
Brass Contributor
Dec 07, 2023

MSSENSE.EXE Exclusions - how and where

We are having file access type issues with various customers over the past week and in each case MSSENSE.EXE is the only thing accessing the files apart from our application. Note that we do not administer customer's AV ourselves - we are in the position of having to advise our customer's IT vendors on exclusions etc.
I see conflicting reports on the web as to whether MSSENSE.EXE respects folder or file extension exclusions set up for the normal AV scanning, or alternatively that it is possible but Microsoft have to do it on the 365 tenant via a support ticket. For our customers at least, MSSENSE.EXE does not seem to respect file and folder exclusions.

 

What is the definitive answer? Is it possible to exclude files\folders from MSSENSE.EXE? If so, how?

 

Thanks in advance

  • AlanPBourke We had a similar issue with some of our apps, you will need to open a case with support to have them put the EDR Exclusion in for you.  These are separate from the AV exclusions you add in the security policies.  When you do open that ticket they will ask you to run the client analyzer tool to capture what mssense is touching, without that, they will not add the exclusion.  They are working on getting the feature added to where you can add your own without supports involvement, you might see if there is a private preview that support can add you into. 

  • Brian2019's avatar
    Brian2019
    Copper Contributor

    AlanPBourke We had a similar issue with some of our apps, you will need to open a case with support to have them put the EDR Exclusion in for you.  These are separate from the AV exclusions you add in the security policies.  When you do open that ticket they will ask you to run the client analyzer tool to capture what mssense is touching, without that, they will not add the exclusion.  They are working on getting the feature added to where you can add your own without supports involvement, you might see if there is a private preview that support can add you into. 

  • rahuljindal-MVP's avatar
    rahuljindal-MVP
    Bronze Contributor
    Do the devices only have Defender AV running or onboarded on Defender for Endpoint?
    • AlanPBourke's avatar
      AlanPBourke
      Brass Contributor
      Mostly onboarded on Defender For Endpoint but possibly some just Defender AV, thanks.
      • jbmartin6's avatar
        jbmartin6
        Iron Contributor
        They would have to be MDE onboarded is mssense.exe is involved. mssense is not part of regular Defender, it is started up when device is onboarded to MDE

Resources