What needs to be excluded and why
Configuration Manager site roles create, rename, and move large numbers of short-lived files through inboxes, outboxes, and the content library. SentinelOne's on-access monitoring can inspect the same file while SMS Executive, Distribution Manager, or a management-point thread expects immediate access, increasing I/O and sometimes producing sharing or access-denied failures.
Microsoft lists symptoms including 80070005 in site logs, stalled Inboxes or MP\OUTBOXES, failed site-system installation, and inaccurate client data. The fix is a narrow, role-specific set of SentinelOne Singularity exclusions for SCCM (Configuration Manager), not an agent disable, whole-drive exclusion, or global *.exe rule.
Where to add the exclusions in the SentinelOne Management Console
Select the smallest scope
In the console's scope selector, choose the Account, Site, or Group containing the affected SCCM servers. A Group dedicated to site servers, management points, or distribution points is safer than Account scope because exclusions inherit downward.
Open Sentinels, then the Exclusions panel or tab. In newer console layouts, the equivalent page can appear under Policy, Policy Settings, or Global Settings. The destination is the exclusion policy for the scope currently selected.
Use the catalog, then add missing records
Select New Exclusion, then Add from Exclusions Catalog. Search for Configuration Manager, SCCM, and Microsoft System Center; if a current matching catalog item appears, review every path and select Apply Exclusions or Exclude for Current Scope.
For a missing item, choose New Exclusion and the Agent Interoperability or Path workflow, select Windows, then Continue. Enter the path, choose As Folder or As File, set Include Subfolders only for folders listed below, add a change-ticket description, and select Add or Save.
Keep the mode supplied by a maintained catalog entry. For manual rules, Suppress Alerts does not address I/O overhead; SentinelOne advises consulting Support before using Interoperability or Performance Focus. Do not select an Extended mode or apply the rule to child processes unless the catalog or Support explicitly requires it, because those settings reduce visibility further.
The actual exclusion list
Resolve the paths on each role
Replace these tokens before saving a rule. SentinelOne supports common Windows variables on current agents, but a verified local path is easiest to audit.
| Token | Default or meaning |
|---|---|
<ConfigMgrInstall> | %ProgramFiles%\Microsoft Configuration Manager |
<MPInstall> | %ProgramFiles%\SMS_CCM |
<ClientInstall> | %Windir%\CCM |
<ContentLibDrive> | The actual drive hosting the content library, often but not always C: |
Folder and file exclusions
Add only the entries belonging to roles installed on that server:
- Site server folders:
<ConfigMgrInstall>\Inboxes,<ConfigMgrInstall>\Logs,<ConfigMgrInstall>\EasySetupPayload, and<ContentLibDrive>\SCCMContentLibwhen the library is local. - Management point folders:
<MPInstall>\ServiceDataand either<ConfigMgrInstall>\MP\OUTBOXESor<InstallDrive>\SMS\MP\OUTBOXES, whichever exists. - Distribution point folders:
<ClientInstall>\ServiceData,<ContentLibDrive>\SCCMContentLib,SMS_DP$,SMSPKG<drive-letter>$,SMSPKG,SMSPKGSIG, andSMSSIG$on the actual content drive. For a D: content drive, realistic examples areD:\SCCMContentLib,D:\SMS_DP$, andD:\SMSPKGD$. - Management point file:
<MPInstall>\PolReqStaging\POL00000.pol.
Use As Folder with subfolders for folder entries and As File for POL00000.pol. Do not replace this list with extensions such as .log, .pol, or .pkg across the server.
Executable path exclusions
Microsoft recommends process exclusions only when the security product treats these executables aggressively. In SentinelOne, add the full executable path as a Path record with As File, rather than excluding the process name everywhere:
<ConfigMgrInstall>\bin\x64\Smsexec.exe<ConfigMgrInstall>\bin\x64\Sitecomp.exe<ConfigMgrInstall>\bin\x64\Smswriter.exe, site server only<ConfigMgrInstall>\bin\x64\Cmupdate.exe, site server only<ConfigMgrInstall>\bin\x64\Smssqlbkup.exe, or its verified path on the site database server<MPInstall>\Ccmexec.exe, management point only
For a colocated or remote site database, follow Microsoft's SQL Server antivirus guidance for the data, log, backup, tempdb, full-text, and FILESTREAM directories actually configured for that instance. Do not invent a default SQL path or exclude every .mdf, .ndf, or .ldf file on the host.
Verification
Confirm policy delivery
Return to Exclusions at the target scope and confirm each record shows Windows, the intended type and mode, and the correct scope. At a child Group, verify the entries appear as inherited, then check the console Activity or audit log for the exclusion change and confirm the endpoint is connected with a recent check-in.
On the server, verify agent health and review the supported Windows event channel:
powershell $ctl = Get-ChildItem (Join-Path $env:ProgramFiles 'SentinelOne\Sentinel Agent *\SentinelCtl.exe') | Sort-Object LastWriteTime -Descending | Select-Object -First 1 & $ctl.FullName status Get-WinEvent -LogName 'SentinelOne/Operational' -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message
sentinelctl status confirms agent health, not a specific match. If the event channel is unavailable on that agent build, use the console's Fetch Logs action rather than treating the missing channel as failure.
Reproduce the SCCM workflow
Interoperability and Performance Focus changes may require the affected process to restart, and system processes can require a reboot. Schedule that restart, then redistribute one known test package and watch <ConfigMgrInstall>\Logs\distmgr.log, pkgxfermgr.log, sitecomp.log, and mpcontrol.log as applicable.
Set $SiteRoot to the verified installation directory and check for old inbox files and recurring errors:
powershell $SiteRoot = Join-Path $env:ProgramFiles 'Microsoft Configuration Manager' Get-ChildItem (Join-Path $SiteRoot 'Inboxes') -Recurse -File | Sort-Object LastWriteTime | Select-Object -First 20 FullName, LastWriteTime Select-String -Path (Join-Path $SiteRoot 'Logs\distmgr.log') -Pattern '80070005|access is denied|failed' | Select-Object -Last 20
The queue should drain, package status should reach Success, and no new matching error should appear. For an Interoperability exclusion, Resource Monitor's CPU > Associated Modules view for smsexec.exe or ccmexec.exe should no longer show SentinelOne InProcessClient32.dll or InProcessClient64.dll after the process restart.
Common pitfalls and what to do if the exclusion is not honored
- Wrong scope: The rule was added at another Site or Group, or a server moved groups. Inspect inheritance from the endpoint's current group.
- Wrong path form: Confirm drive letters, custom install locations, and folder/file selection. If needed, use a supported variable or SentinelOne's
\Device\HarddiskVolume*\...form, not?:\.... - Remote content: Put the exclusion on the server whose SentinelOne agent scans the files. A remote content library path does not belong on the site server when no local copy exists.
- No restart: Restart the affected SCCM service in a maintenance window or reboot. A running process can retain SentinelOne instrumentation from the old policy.
- Wrong mode: Suppress Alerts hides detections but does not remove monitoring overhead. Performance Focus can remove valuable telemetry, so escalate instead of broadening it experimentally.
- Another scanner: Confirm Microsoft Defender or another endpoint product is not still scanning the same paths.
If the rule still misses, run SentinelOne's Agent Activity Analyzer during a reproducible content job, fetch the endpoint logs from the console, and open a Support case with timestamps, server role, agent version, exclusion export, and SCCM log excerpts. Keep protection enabled while Support identifies the narrowest working rule.
Where to find the vendor's authoritative documentation
Use the SentinelOne Resource Center as the canonical public source. From your own console, open Help > Online Help for release-matched pages covering the Exclusions Catalog, exclusion best practices, path syntax, and Agent Activity Analyzer.
The path list above follows Microsoft's current recommended antivirus exclusions for Configuration Manager. Recheck both vendors' guidance after a SentinelOne agent upgrade, Configuration Manager current-branch update, or site-role change.