[Issue]Test-ExchAVExclusions.ps1 and Non-Default modules

[FernandoGualano]

Describe the issue
When I run the Test-ExchAVExclusions.ps1 script in my Exchange 2019 enviroment, the output file NonDefaultModules.txt report show some AV Modules and their path:

However, the security team confirms that the exclusions are configured correctly. We uninstalled the antivirus software, ran the script again and got the same result, even though the locations and processes no longer exist:

I understand that this behavior is abnormal.

Thanks!!

[lusassl-msft]

@iserrano76 one more feedback regarding the check. Maybe we can rework the output to become a little more clearer?

[iserrano76]

Describe the issue When I run the Test-ExchAVExclusions.ps1 script in my Exchange 2019 enviroment, the output file NonDefaultModules.txt report show some AV Modules and their path:

However, the security team confirms that the exclusions are configured correctly. We uninstalled the antivirus software, ran the script again and got the same result, even though the locations and processes no longer exist:

I understand that this behavior is abnormal.

Thanks!!

If I am not wrong we only write the file if we found any unexpected module.

@FernandoGualano, did you receive any information about wrong modules on screen output?

Could be that this info comes from a previous execution?

was the date that show the file before or after the uninstallation?

Thanks for the feedback!!

[FernandoGualano]

Thanks @iserrano76 for your reply!
The date that show the file it's after the uninstallation. First, we uninstalled the AV and then, we ran the script again and got the same result.

I am attaching 2 files: one includes the logs when I ran the script with the AV installed and configured; and another, without having the AV installed.
AV_Uninstalled.zip
AV_Installed+Exclusions_configured.zip

Thanks!

[iserrano76]

Thanks @iserrano76 for your reply! The date that show the file it's after the uninstallation. First, we uninstalled the AV and then, we ran the script again and got the same result.

I am attaching 2 files: one includes the logs when I ran the script with the AV installed and configured; and another, without having the AV installed. AV_Uninstalled.zip AV_Installed+Exclusions_configured.zip

Thanks!

It is weird, those modules appear as we check the modules in memory but if you want we can do a remote session and try to understand what happens on your side.

[iserrano76]

I was in remote session with @FernandoGualano but we were not able to reproduce the issue.
The script was showing the information about the AV when the AV was attached and do not show information when it was not attached.
If we cannot reproduce it we can close this issue.
At the same time we were working on output improvements on #1894 as @lusassl-msft suggested

[FernandoGualano]

Thanks @iserrano76 for your assistance!
The costumer said me that he has already escalated the issue with the antivirus vendor to review the issue of exceptions.
Surely the initial behavior we had was because, after uninstalling the AV, the server would not have been restarted, leaving the AV modules in memory since we were unable to reproduce the issue.

Now, I'm waiting for customer feedback

Thanks a lot!

[iserrano76]

Hi @FernandoGualano
Do you have any news from customer?
If you did not see again a false positive maybe we can close this as we have new improvements in the output and this one looks that was because was in memory before reboot.
Let us know if you have anything from your side.

[iserrano76]

@lusassl-msft I think we can archive this one at it looks a false positive and it is not happening anymore.
Additionally, we improved the output of the script in #1933, #1783 and # 1848.