DataGuard blocks svchost.exe. Can we exclude svchost.exe from being blocked by DataGuard?

Issue:

DataGuard feature blocks svchost.exe. Can we exclude svchost.exe from being blocked by DataGuard? 

Resolution:

If DataGuard blocks svchost.exe, it is not recommended to add svchost.exe to the Manually added trusted applications and folders list since svchost.exe can be used by various processes and therefore it is not possible to fully know if the svchost operation is harmful or not. 

If the folder, where svchost.exe is trying to access or modify a file, was automatically protected due to the Discover monitored user data folders automatically feature, you can add the folder to the Manually excluded folders list in the profile so that DataGuard will not block svchost. 

Steps for Elements Endpoint Protection:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the device 
4. Go to the DataGuard settings page
5. Scroll down to the Monitored folders section
6. Under Manually excluded folders, click Add path 
7. Enter the path to the folder you want to exclude
   1. Note: All sub-folders will also be excluded
   2. Note: Wildcards and environment variables are supported
8. Click Save profile

Steps for Client Security:

Client Security does not have a Manually excluded folders feature, so you will need to disable the protection for that specific automatically protected folder. For example svchost.exe is blocked due to file being in the Documents folder, you can disable the protection specifically for the Documents folder:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > DataGuard
5. In the Protected data folders table, disable the protection for a folder
6. Distribute the policy (Ctrl + D)