Introduction:
The global exclusions for 6.x only include file types and folder paths. In 7.5 registry exclusions was added as a new feature. This document will discuss the registry exclusions for 7.5 and above versions.
Purpose:
To be able to add global exclusions for registry so that the fslx driver will ignore specified registry trees and or keys.
Definitions:
MACHINE = HKEY Local Machine
USERS = HKEY USERS
HKey Classes Root is a mapping to HKLU\Software\Classes (https://msdn.microsoft.com/en-us/library/windows/desktop/ms724475(v=vs.85).aspx ). To be able to do an exclusion for HKCR you have to map to \REGISTRY\MACHINE\Software\Classes\<path to tree>
HKey Current Users is a mapping to HKU\<SSID>. To be able to do an exclusion for HKCU you will have to map to \REGISTRY\USERS\<sid of user>\<path to tree>
Syntax:
\REGISTRY\<one of the above variable names from definitions>\SOFTWARE\<path to tree>
NOTE: the Global exclude is case sensitive any mistypes will be ignored by the fslx.sys driver.
Process to add Global Excludes:
Svsadmin:
The RegistyExludePaths does not exist by default and you can create it manually or use the svsadmin.exe to create the first by going to File>Global Excludes> right click anywhere in the windows>
New Exclude Entry> Select Registry> Use the information from the Syntax section.
Manual:
Once you add the key you can verify it by reloading the global entry window in the svsadmin tool.
- Browse to the FSL key @ HKLM\System\CurrentControlset\Services\FSLX\Parameters\FSL
- Right click on FSL and go to NEW> multi-string value.
- Value name = RegistryExcludePaths
- Value Data is “0x003 \REGISTRY\MACHINE\SOFTWARE\7-zip”
NOTE: Symantec suggests using the svsadmin tool to add global excludes. After the hex data “0x003” there is a tab and not multiple spaces. If you want multiple excludes do a new line for each exclude. Once you export the registry key you will see the multi-string converted to hex.
Example Key:
"RegistryExcludePaths"=hex(7):30,00,78,00,30,00,30,00,30,00,33,00,09,00,5c,00,\
52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,00,5c,00,4d,00,41,00,43,00,48,\
00,49,00,4e,00,45,00,5c,00,64,00,65,00,72,00,70,00,00,00,30,00,78,00,30,00,\
30,00,30,00,33,00,09,00,5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,\
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,64,00,65,00,72,00,\
70,00,32,00,00,00,00,00
Same key above in regedit:
