Security Whitelisting for Endpoint Backup on Windows

CrashPlan Endpoint Backup includes components that may require elevated privileges to install and operate. Antivirus, application protection, exploit detection, advanced threat protection, and other security software can block, quarantine, or lock CrashPlan components.

To help ensure that CrashPlan Endpoint Backup operates correctly, add the required CrashPlan folders, executables, configuration files, and service to your security software's allowlist or exclusions.

This guidance applies to CrashPlan Agent version 4.0.0 and later.

Exclude CrashPlan folders

Add the following folders to your security software exclusions:

Replace {USER_NAME} with the applicable Windows user name.

Whitelist CrashPlan executables

Add the following executables as trusted applications:

• elevate.exe

• CrashPlanBackupService.exe

• CrashPlan Backup For Endpoints.exe

• Uninstall CrashPlan Backup For Endpoints.exe

Exclude CrashPlan configuration files

Add the following configuration files to your security software exclusions:

• config.yaml

• WL.properties

Whitelist the CrashPlan service

Add the following Windows service as a trusted application:

CrashPlanBackupService

Whitelisting the service helps prevent security software from stopping or removing it.

Configure VSS scanning

CrashPlan uses Volume Shadow Copy Service (VSS) to create a point-in-time copy of data for backup. Disable real-time or on-demand scanning of VSS volumes to prevent security software from interfering with the backup process.

Scheduled antivirus scans of VSS volumes can remain enabled.

Verify the configuration

After configuring the exclusions:

1. Verify that the required folders are excluded from scanning.

2. Verify that the listed executables are trusted.

3. Verify that the configuration files are excluded.

4. Verify that CrashPlanBackupService is allowed to run.

5. Confirm that real-time and on-demand VSS scanning is disabled.

6. Start or restart the CrashPlan agent and verify that it operates normally.