Anti Virus Exclusions

These are exclusions specific for Microsoft

Av exclusions for Microsoft AppV v5

Av exclusions for Microsoft FSLogix

Av exclusions for Microsoft Internet Information Services

Av exclusions for Microsoft Intune Win32

Av exclusions for Microsoft Office OneDrive

Av exclusions for Microsoft Office Outlook

Av exclusions for Microsoft Teams v1 (Classic)

Av exclusions for Microsoft Teams v2

Av exclusions for Microsoft Windows Active Directory Controller

Av exclusions for Microsoft Windows Group Policy

NOTE: Group Policy exclusions apply to Windows Server only. If you're using Microsoft Defender Antivirus, Group Policy exclusions are included in automatic server role exclusions.

Source: Microsoft

Source: Microsoft Defender Antivirus exclusions on Windows Server

Av exclusions for Microsoft Windows Security files

NOTE: If these files are not excluded, antivirus software might prevent appropriate access to these files, and security databases can become corrupted. Scanning these files can prevent the files from being used or might prevent a security policy from being applied to the files. These files should not be scanned because antivirus software might not correctly treat them as proprietary database files.
These are the recommended exclusions. There might be other file types that are not included in this article that should be excluded.

Source: Microsoft

Source: Microsoft Defender Antivirus exclusions on Windows Server

Av exclusions for Microsoft Windows Update

Source: Microsoft

Source: Microsoft Defender Antivirus exclusions on Windows Server

Av exclusions for Microsoft Windows User Profile

Source: Microsoft

Source: Microsoft Defender Antivirus exclusions on Windows Server

Av exclusions for Microsoft Windows

Source: Microsoft

These are exclusions specific for Citrix
When using non-persistent images, all changes are lost after a reboot. This also applies to antivirus definitions and possible contaminations. Depending on the degree of security desired, a decision can be made as to whether it will be necessary to install an antivirus agent on the virtual desktop. The following antivirus exclusions should be applied to all Citrix infrastructure servers:

• Set real-time scanning to scan local drives only and not network drives
• Disable scan on boot
• Remove any unnecessary antivirus related entries from the Run key
• Exclude the pagefile(s) from being scanned
• Exclude Windows event logs from being scanned
• Exclude IIS log files from being scanned
• Exclude the print spooler directory (to improve print performance)

It is recommended to update a master image or vDisk at least once a month, this is to keep the size of the virus definition files to a minimum. For updating only the definition files it of no importance how the image gets updated (vDisk version, editing a MCS image or enrolling an entirely new image). Applying the new definition files must occur during computer start-up and at a random interval during business hours (most virtualization aware anti-virus solutions provide such a function). Start-up of the Citrix services should be delayed to ensure enough time is available to update the definition files. This can be done by altering the service start-up method to 'delayed start', or by implementing a script to 'manually' start the services after a period of time. Virus definitions sizes tent to increase over time, this timeframe must be taken into account.
General source information can be found at: Article: Guidelines Tech Zone article

Av exclusions for Citrix Cloud Connector

Av exclusions for Citrix Director

NOTE: Configure only the IIS Exclusions
Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Federated Authentication Service (FAS)

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Provisioning Services Service

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Provisioning Services Target Device

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Session Recording Agent

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Session Recording Player

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Session Recording Server

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix StoreFront

NOTE: Also configure the IIS Exclusions
Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix User Profile Management

Source: Article: Citrix Guidelines for Antivirus Software Configuration for Citrix Profile Management Source: Tech Zone Article

Citrix Virtual Apps and Desktops Delivery Controller

NOTE: Also configure the IIS Exclusions when IIS installed on the same server.
Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Virtual Apps and Desktops VDA (Multi Session)

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Virtual Apps and Desktops VDA (Single Session)

Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Workspace Environment Management Infrastructure Service Agent

NOTE: On a 64- bit system, by default, the installation directory will exist in "%ProgramFiles(x86)%" instead of "%ProgramFiles%" on 32-bit systems. NOTE: Older versions of the agent can be installed in %ProgramFiles(x86)%\Norskale\Norskale Agent Host. Make sure to check the installation directory before configuring antivirus exclusions.
Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix Workspace Environment Management Infrastructure Service

NOTE: On a 64- bit system, by default, the installation directory will exist in "%ProgramFiles(x86)%" instead of "%ProgramFiles%" on 32-bit systems.
Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Citrix WorkspaceApp

NOTE: Exclusions for the Citrix Workspace app are typically not required. A need arises in environments with antivirus configured with more strict than usual policies, or in situations in which multiple security agents are simultaneously in use (AV, DLP, HIP, and so on). When installing Citrix Workspace app using the Virtual Delivery Agent installer, an "Online plug-in" folder is present in the install path such as %ProgramFiles(x86)%\Citrix\online plugin\ICA Client\
Source: Tech Paper: Endpoint Security, Antivirus, and Antimalware Best Practices

Ivanti

Ivanti Automation Agent

NOTE: On a 64- bit system, by default, the installation directory will exist in "%ProgramFiles(x86)%" instead of "%ProgramFiles%" on 32-bit systems.
Source: Ivanti Automation Antivirus Best Practices

Ivanti Automation Console

Source: Ivanti Automation Antivirus Best Practices

Ivanti Automation Dispatcher

Source: Ivanti Automation Antivirus Best Practices

Ivanti Security Controls

NOTE: Console executables (located in the installation directory) can be in different locations depending on the version. Console Directories

2019.3 and earlier

- C:\ProgramData\Landesk\Shavlik Protect

- C:\Program Files\LANDESK\Shavlik Protect (by default, may be custom)

2020.1 and later

- C:\ProgramData\Ivanti\Security Controls

- C:\Program Files\Ivanti\Security Controls (by default, may be custom)

Source: Antivirus Exclusions for Ivanti Security Controls

Ivanti Workspace Control Agent

NOTE: On a 64- bit system, by default, the installation directory will exist in "%ProgramFiles(x86)%" instead of "%ProgramFiles%" on 32-bit systems.
Source: Ivanti Workspace Control Antivirus Best Practices

Ivanti Workspace Control Console

NOTE: On a 64- bit system, by default, the installation directory will exist in "%ProgramFiles(x86)%" instead of "%ProgramFiles%" on 32-bit systems.
Source: Ivanti Workspace Control Antivirus Best Practices

Ivanti Workspace Control Relay Service

Source: Ivanti Workspace Control Antivirus Best Practices

ESET