Certain changes need to be made in order to configure the SWS (Streaming) agent and the SWV (Virtualization) agent for optimal use with Symantec Endpoint Protection (SEP) 12.x.
For the SWS Agent
With the SWS Agent configuration, the process name is all that is required (no path needed).
For SEP 12.0 and older, the pre-defined NO_ACCESS_PROCESSES list (found in AppstreamCfg.txt) is sufficient.
For SEP 12.1 and higher, ccSvcHst.exe must be manually added to the NO_ACCESS_PROCESSES list.
For the SWV Agent
For SEP 12.0 and older, the pre-define ProgramIgnoreList (located under HKLM\System\CurrentControlSet\Services\FSLX\Parameters\FSL). If SEP is installed to a non-default location, the path in the ProgramIgnoreList needs to be changed accordingly.
Beginning with SEP 12.1, the ProgramIgnoreList must include a path of the following form: