CrowdStrikeintermediate

How to Configure CrowdStrike Exclusions for SharePoint Server

Recommended exclusions for Microsoft SharePoint Server in CrowdStrike Falcon

10 min readUpdated January 2025

Last Updated: February 2025

Overview

File-level antivirus software can cause significant issues with SharePoint operations if not properly configured. Incorrect antivirus configuration can lead to “access denied” errors during file uploads, search indexing failures, workflow disruptions, and performance degradation across your SharePoint farm.

This guide provides comprehensive exclusion recommendations for CrowdStrike Falcon when protecting SharePoint environments, based on Microsoft's official antivirus exclusion guidance for SharePoint.

⚠️ Critical Security Notice: While these exclusions prevent operational conflicts and maintain SharePoint performance, they reduce CrowdStrike’s security coverage. Each exclusion creates a potential security vulnerability. Organizations must implement compensating controls and carefully evaluate the risks versus operational requirements.

Supported SharePoint Versions

This guide covers exclusions for:

  • SharePoint Server Subscription Edition
  • SharePoint Server 2019
  • SharePoint Server 2016
  • SharePoint Server 2013
  • SharePoint Foundation 2013
  • SharePoint Server 2010
  • SharePoint Foundation 2010
  • Windows SharePoint Services 3.0
  • SharePoint Server 2007
  • SharePoint Workflow Manager
  • Office Online Server

Common Issues Without Proper Exclusions

Without appropriate exclusions, you may experience:

  • “Access denied” errors when uploading files
  • Search crawl and indexing failures
  • Workflow execution interruptions
  • Document library corruption
  • Web part rendering issues
  • Timer job failures
  • Service application disruptions
  • Content database locks
  • Configuration cache corruption
  • Temporary file conflicts
  • Office Online Server document conversion failures
  • Performance degradation during peak usage

Prerequisites

  • CrowdStrike Falcon administrative access
  • Access to the Falcon Console: https://falcon.crowdstrike.com or https://falcon.us-2.crowdstrike.com/ (varies by tenant)
  • SharePoint installation paths documented
  • SharePoint Management Shell access
  • List of all SharePoint servers and their roles
  • Service account information
  • Understanding of your SharePoint topology

Step 1: Access CrowdStrike Falcon Console

  1. Open your browser and navigate to your Falcon Console:
    • Primary: https://falcon.crowdstrike.com
    • US-2: https://falcon.us-2.crowdstrike.com/
    • (Contact your CrowdStrike administrator if unsure of your tenant location)
  2. Sign in using your admin credentials
  3. Navigate to Endpoint Security > Configure > Exclusions

Step 2: Configure SharePoint Core Exclusions

Note: In all paths below, Drive: represents the drive letter where SharePoint is installed (typically C:).

SharePoint Server Subscription Edition, 2019, and 2016

Add these folder exclusions:

Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*

Or exclude specific critical folders:

Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\*
Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\Logs\\*
Drive:\\Program Files\\Microsoft Office Servers\\16.0\\Data\\Office Server\\Applications\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\*
Drive:\\Users\\ServiceAccount\\AppData\\Local\\Temp\\WebTempDir\\*
Drive:\\ProgramData\\Microsoft\\SharePoint\\*
Drive:\\Users\\[SearchServiceAccount]\\AppData\\Local\\Temp\\*
Drive:\\WINDOWS\\System32\\LogFiles\\*
Drive:\\Windows\\Syswow64\\LogFiles\\*

Service Account Specific Exclusions

If using specific accounts for SharePoint services:

Drive:\\Users\\ServiceAccount\\AppData\\Local\\Temp\\*
Drive:\\Users\\Default\\AppData\\Local\\Temp\\*

BLOB Cache Exclusions

If using disk-based BLOB cache:

C:\\Blobcache\\*
[Or your configured BLOB cache location]

IIS Virtual Directories

Exclude all virtual directory folders:

Drive:\\inetpub\\wwwroot\\wss\\VirtualDirectories\\*
Drive:\\inetpub\\temp\\IIS Temporary Compressed Files\\*

Step 3: Configure SharePoint Workflow Manager Exclusions

If using SharePoint Workflow Manager, add these exclusions:

Drive:\\Program Files\\Workflow Manager\\*
Drive:\\Program Files\\Reference Assemblies\\Microsoft\\Workflow Manager\\*
Drive:\\Program Files\\Service Bus\\*
Drive:\\ProgramData\\Workflow Manager\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Temporary ASP.NET Files\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\*
Drive:\\inetpub\\*
Drive:\\Windows\\System32\\inetsrv\\*
Drive:\\Windows\\SysWOW64\\inetsrv\\*
Drive:\\Users\\Default\\AppData\\Local\\Temp\\*

Step 4: Configure Office Online Server Exclusions

For Office Online Server (formerly Office Web Apps Server):

Folder Exclusions

Drive:\\Program Files\\Microsoft Office Web Apps\\*
Drive:\\ProgramData\\Microsoft\\OfficeWebApps\\Working\\d\\*
Drive:\\ProgramData\\Microsoft\\OfficeWebApps\\Working\\waccache\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\*

Office Online Server Process Exclusions

Add these processes to exclusions:

AgentManagerWatchdog.exe
AppServerHost.exe
broadcastwatchdog_app.exe
broadcastwatchdog_wfe.exe
DiskCacheWatchdog.exe
EditAppServerHost.exe
EditAppServerHostSlim.exe
excelcnv.exe
FarmStateManagerWatchdog.exe
FarmStateReplicator.exe
HostingServiceWatchdog.exe
ImagingService.exe
ImagingWatchdog.exe
MetricsProvider.exe
Microsoft.Office.Excel.Server.EcsWatchdog.exe
Microsoft.Office.Excel.Server.WfeWatchdog.exe
Microsoft.Office.Web.AgentManager.exe
Microsoft.Office.Web.WebOneNoteWatchdog.exe
OneNoteMerge.exe
ppteditingbackendwatchdog.exe
pptviewerbackendwatchdog.exe
pptviewerfrontendwatchdog.exe
ProofingWatchdog.exe
SandboxHost.exe
SpellingWcfProvider.exe
ULSControllerService.exe
W3wp.exe
WordViewerAppManagerWatchdog.exe
WordViewerWfeWatchdog.exe

Important: Monitor or reduce risk for the AppServerHost.exe process and the wacsm Microsoft service.

Step 5: Configure SharePoint 2013 Specific Exclusions

SharePoint Server 2013

In addition to Foundation exclusions, add:

Drive:\\Program Files\\Microsoft Office Servers\\15.0\\Data\\*
Drive:\\Program Files\\Microsoft Office Servers\\15.0\\Logs\\*
Drive:\\Program Files\\Microsoft Office Servers\\15.0\\Bin\\*
Drive:\\Program Files\\Microsoft Office Servers\\15.0\\Synchronization Service\\*

SharePoint Foundation 2013

Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\Logs\\*
Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\Data\\Applications\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\*
Drive:\\Users\\ServiceAccount\\AppData\\Local\\Temp\\WebTempDir\\*
Drive:\\ProgramData\\Microsoft\\SharePoint\\*
Drive:\\Users\\[SearchServiceAccount]\\AppData\\Local\\Temp\\Gthrsvc_spsearch4\\*
Drive:\\WINDOWS\\System32\\LogFiles\\*
Drive:\\Windows\\Syswow64\\LogFiles\\*

Step 6: Configure SharePoint 2010 Specific Exclusions

SharePoint Server 2010

Drive:\\Program Files\\Microsoft Office Servers\\14.0\\Data\\*
Drive:\\Program Files\\Microsoft Office Servers\\14.0\\Logs\\*
Drive:\\Program Files\\Microsoft Office Servers\\14.0\\Bin\\*
Drive:\\Program Files\\Microsoft Office Servers\\14.0\\Synchronization Service\\*

SharePoint Foundation 2010

Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Logs\\*
Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\Data\\Applications\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Temporary ASP.NET Files\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\*
Drive:\\Users\\ServiceAccount\\AppData\\Local\\Temp\\WebTempDir\\*
Drive:\\ProgramData\\Microsoft\\SharePoint\\*
Drive:\\Users\\[SearchServiceAccount]\\AppData\\Local\\Temp\\Gthrsvc_spsearch4\\*

Step 7: Configure Legacy SharePoint Exclusions

Windows SharePoint Services 3.0

Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\12\\Logs\\*
Drive:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\12\\Data\\Applications\\*
Drive:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Temporary ASP.NET Files\\*
Drive:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Temporary ASP.NET Files\\*
Drive:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\*
Drive:\\Windows\\Temp\\WebTempDir\\*
Drive:\\Documents and Settings\\[SearchServiceAccount]\\Local Settings\\Temp\\*
Drive:\\Users\\[SearchServiceAccount]\\Local\\Temp\\*

SharePoint Server 2007

Drive:\\Program Files\\Microsoft Office Servers\\12.0\\Data\\*
Drive:\\Program Files\\Microsoft Office Servers\\12.0\\Logs\\*
Drive:\\Program Files\\Microsoft Office Servers\\12.0\\Bin\\*

Installation Note: When installing SharePoint Server 2007 or applying hotfixes, you may need to temporarily disable real-time scanning or exclude Drive:\\Windows\\Temp.

Step 8: Configure Search Service Exclusions

Critical Search Exclusions

The search service requires special attention:

  1. Index Location:
[Default or Custom Index Location]\\*
  1. NodeRunner Process:
    • Used for indexing process
    • Ensure noderunner.exe is excluded
    • Search Service Account Temp:
    Drive:\\Users\\[SearchServiceAccount]\\AppData\\Local\\Temp\\Gthrsvc_spsearch4\\*

    Frequently Asked Questions

    Find answers to common questions

    Implementing recommended exclusions for SharePoint Server in CrowdStrike Falcon can improve performance but may expose the system to security vulnerabilities. Excluding entire installation paths allows malicious files to execute undetected, increasing risks of data breaches. To mitigate these risks, organizations should establish compensating controls such as strict access policies, regular security audits, and enhanced monitoring of excluded directories. Application whitelisting can restrict execution to approved applications, and a robust incident response plan is essential for addressing potential security incidents. Utilizing endpoint detection and response (EDR) systems can help identify threats that bypass traditional antivirus solutions. Regularly reviewing and updating the exclusion list is crucial to maintaining security as the SharePoint environment evolves.

    Need Professional Help?

    Our team of experts can help you implement and configure these solutions for your organization.

    Contact Our TeamView Our Services

    Related Articles

    CrowdStrike User Roles: Create Custom Roles & Manage Permissions

    Create and manage user roles in CrowdStrike Falcon with custom permissions. Step-by-step guide to configure role-based access control (RBAC), assign permissions, and restrict user access to Falcon console features.

    Read More →

    CrowdStrike Exchange Exclusions | Configure Falcon for Exchange Server

    Configure essential CrowdStrike exclusions for Microsoft Exchange Server. Protect database files, transaction logs, and processes to prevent corruption and ensure mail flow.

    Read More →

    Deploy CrowdStrike Falcon via GPO | Active Directory Guide

    Step-by-step guide to deploy CrowdStrike Falcon sensors using Group Policy. Silent installation, startup scripts, troubleshooting tips for AD environments.

    Read More →
    Back to CrowdStrike