Antivirus and Defender Exclusions for Video Management Systems

Of all the questions I get about video servers, this is the one I get most, and it is the one where the wrong answer does the most damage in both directions. Leave antivirus scanning the archive and the Archiver drops frames, the recording server falls behind, and eventually video is missing when someone needs it. Exclude the whole drive because the vendor told you to and the server that holds the evidence is now the least protected machine on the network.

The right answer is narrow, specific exclusions, applied to the paths and processes that actually need them, verified after the fact. This page is that list for the four platforms I see most, and the Defender mechanics for applying it. It applies to any endpoint product; Defender is the worked example because it is what most Windows servers now run.

Why scanning breaks recording

A recording server writes video continuously. The Genetec Archiver writes .g64x files at a steady rate for every camera it owns. Milestone’s recording server writes into its media database in blocks. Every one of those writes is a file operation, and real-time protection intercepts file operations. Scanning a large file that changes every few seconds means scanning it over and over, and the scan holds the write until it completes.

At small scale the cost hides. At two hundred cameras it is visible as a recording server that cannot keep up with its own cameras, disk queue lengths that never drop, and gaps in the timeline that nobody can explain because the network was fine and the disks were fine. The video files are not executable and are not a plausible malware vector in the format the recorder writes. Scanning them costs a great deal and protects against nothing.

The same applies to the database files under the platform: SQL data and log files, the Milestone configuration database, the index files that make the timeline work. They are opened for exclusive write and scanned repeatedly for the same non-benefit.

The rules before the lists

• Exclude paths and processes, not drives. A drive-level exclusion is a security finding on every audit framework you are likely to face, and it is unnecessary. The recorder writes to specific directories.
• Prefer process exclusions where the product supports them. Excluding the recording process from scanning means files it writes are not scanned on write, regardless of path. That covers archive volumes that get added later without anyone updating the exclusion list.
• Extension exclusions are a supplement, not a substitute. They catch video files wherever they land, which matters for exports and archive transfer targets, but they are broad, so keep them to the formats the recorder actually produces.
• Disable the bundled extras. Network inspection, firewall modules, and “scan on definition update” features in third-party suites interfere with camera traffic and add load. The scanning engine is the part you want; the rest is usually a problem.
• Keep the exclusions in Group Policy or Intune, not on the server. A local exclusion survives until someone reimages the box. A policy survives.
• Write them down. The exclusion list is a security decision, and the auditor will ask for it.

Genetec Security Center

Genetec publishes its list in the Enterprise Best Practices guide, and the paths below follow it. Adjust for non-default install locations, and add every volume the Archiver writes to.

# Installation
C:\Program Files (x86)\Genetec Security Center 5.14\
C:\ProgramData\Genetec Security Center 5.14\

# Health Monitor cache (the .tik / .xml / .units / .cameras churn lives here)
C:\ProgramData\Genetec Security Center 5.14\HealthMonitoring\

# Every video archive root, on every Archiver
D:\VideoArchive\
E:\VideoArchive\

# SQL Server data, log, TempDB, and backup paths
D:\SQLData\
L:\SQLLog\
T:\TempDB\
B:\SQLBackup\

# Processes
GenetecServer.exe
GenetecWatchdog.exe
sqlservr.exe

# Extensions
.g64  .g64x  .gek  .mdf  .ldf  .ndf  .bak

On StreamVault appliances the bundled endpoint protection ships with these exclusions already configured. If you replace it with Defender or a corporate suite, every one of them has to be re-created. This is the most common way a StreamVault ends up with an unhappy Archiver six months after a security team “standardised” it.

Milestone XProtect

Milestone’s recording server keeps its media database in a directory tree of fixed-size block files, plus the configuration and the log database on the management server. The list Milestone recommends covers the install, the data, and the media database file types.

# Installation and data
C:\Program Files\Milestone\
C:\ProgramData\Milestone\

# Media database roots (every recording server, every storage and archive path)
D:\MediaDatabase\
E:\MediaDatabase\

# SQL Server (management server) data and log paths, as above

# Processes
VideoOS.Recorder.Service.exe
VideoOS.Server.Service.exe
VideoOS.Recorder.Service.Host.exe
sqlservr.exe

# Media database extensions
.blk  .idx  .pic  .pqz  .sts  .ts

Milestone archives by moving blocks from live storage to archive storage on a schedule. Both roots need excluding, and the archive root is the one that gets forgotten, because it was added after commissioning when the first storage filled up.

Avigilon Unity (ACC)

Avigilon documents exclusions for the server install directory and the configured data volumes. The data volumes are set per server in the ACC Admin Tool, and every one of them needs to be on the list.

# Installation
C:\Program Files\Avigilon\
C:\ProgramData\Avigilon\

# Every configured data volume from ACC Admin Tool
D:\AvigilonData\
E:\AvigilonData\

# Processes
The ACC server service executable under the install directory

Avigilon appliances ship with the exclusions present. The same warning as StreamVault applies: replacing the endpoint product means recreating them, and the appliance will not warn you when they are gone.

Axis Camera Station

Camera Station keeps its configuration and its recording index under ProgramData and writes recordings to whatever storage was configured per camera or per site.

# Installation and data
C:\Program Files\Axis Communications\
C:\ProgramData\Axis Communications\

# Every configured recording location
D:\Recordings\

# Processes
The AXIS Camera Station server service executable under the install directory

Applying them in Microsoft Defender

Defender takes exclusions as paths, processes, and extensions, and applies them to real-time protection and scheduled scans. Apply them through Group Policy under Windows Components, Microsoft Defender Antivirus, Exclusions, or through Intune, so that they survive a rebuild. For a lab or a one-off, PowerShell does the same thing locally:

Add-MpPreference -ExclusionPath "D:\VideoArchive"
Add-MpPreference -ExclusionPath "C:\ProgramData\Genetec Security Center 5.14"
Add-MpPreference -ExclusionProcess "GenetecServer.exe"
Add-MpPreference -ExclusionProcess "sqlservr.exe"
Add-MpPreference -ExclusionExtension ".g64x"

Two Defender features beyond the scanning engine will stop a recorder cold and neither is an exclusion:

• Controlled Folder Access blocks unrecognised processes from writing to protected folders. If it is on, the recording process must be added as an allowed application, or the archive root must not be a protected folder. Turning it on through a corporate baseline without the allow entry is a reliable way to stop all recording at once.
• Attack Surface Reduction rules can block the child processes and script activity some platforms use during install and update. Test the baseline in audit mode on a recorder before enforcing it.

Proving they took

An exclusion that is in the policy but not on the server is worth nothing, and policy inheritance on a server that was moved between OUs is not something to assume. Check the effective state on the machine:

Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusSignatureLastUpdated

Then check the thing you actually care about. Recording servers expose disk write latency and queue length in Performance Monitor; the platform’s own health dashboard shows dropped frames or recording gaps. Take a baseline before the exclusions, apply them, and compare. On a server that was suffering, the disk queue length on the archive volume drops visibly within minutes.

Finally, put the exclusion list in the system documentation next to the retention policy and the network diagram. It is part of the design. When the security team next standardises the endpoint fleet, it is the document that keeps the recorder recording.