Antivirus Exclusions for the Windows Forwarder
Exclude three Stairwell paths from your endpoint protection software, so the two are not competing to read the same files.
Your antivirus and the Stairwell forwarder both want to read every file on the machine, and left alone they will read each other's work. Excluding three Stairwell paths from real-time scanning stops that contention.
This is worth doing rather than optional. Customers report a substantial improvement in file scanning performance after adding these exclusions in Microsoft Defender. If the forwarder feels heavy on a fleet, this is the first thing to check, before performance tuning or anything else.
What to exclude
| Component | Path |
|---|---|
| Forwarder data directory | C:\ProgramData\Stairwell |
| Forwarder kernel driver | C:\Windows\System32\drivers\SWAgent.sys |
| Forwarder process | C:\Program Files\Stairwell\SwellService\SwellService.exe |
Two details decide whether the exclusion actually takes effect:
Include subfolders on the directory exclusion. A policy that excludes C:\ProgramData\Stairwell but not what is under it does very little, since that is where the work happens.
Exclude from on-access and real-time engines specifically. A scheduled-scan exclusion does not address the contention, because the contention is real-time.
Other antivirus vendors
Some vendors require a wildcard or trailing asterisk on path exclusions:
C:\ProgramData\Stairwell\*Check your vendor's documentation for the exact format. A path exclusion in the wrong syntax is usually accepted without complaint and silently matches nothing, which looks identical to having made no change at all. If performance does not improve after applying these, suspect the syntax before suspecting the advice.
Does this create a blind spot?
Not in the sense that matters. You are excluding Stairwell's own working directory and binary from your antivirus, not excluding anything the forwarder collects. Stairwell continues to collect and analyze files across the machine exactly as before, and your antivirus continues to protect everything except the three paths above.
What should I read next?
- Forwarder Performance Tuning, for the other levers if the machine is still loaded.
- Recommended Exclusions, which is the opposite direction: paths Stairwell should not collect from.
- Windows Forwarder Troubleshooting, if the forwarder is misbehaving rather than merely busy.
Updated 17 days ago