Skip to main content

Antivirus Exclusion List for ProfileUnity Program Files and Directories

Glen Porter
  • Created:
  • Updated:
Antivirus Exclusion List for ProfileUnity

Antivirus (AV) software that actively scans ProfileUnity program files and directories can cause two types of problems during user logon:

  • Performance degradation — AV scanning adds latency to logon operations, particularly on virtual machines.
  • File corruption — Real-time scanning can interrupt ProfileUnity file I/O, resulting in corrupted profiles, packages, or portability data.

This article provides the recommended AV exclusion paths in two phases. Start with Phase 1 (local program files and filter drivers) — this alone resolves the majority of AV-related logon issues. Add Phase 2 exclusions for network shares and runtime temp paths.

ℹ️ Applies to ProfileUnity 6.8.5 and later (current release: 6.9.5)
Filter driver filenames vary by version and can change after a hotfix update. Always verify active driver filenames using the PowerShell command in Phase 1 or by checking the ProfileUnity Hot Fix List.

Phase 1 — Local Program Files and Filter Drivers

Apply these exclusions first. This alone resolves the majority of AV-related logon performance issues.

ProfileUnity Client Installation Directory

Exclude the entire installation folder and all subfolders recursively:

C:\Program Files\ProfileUnity\
Wildcard syntax varies by AV product
Common formats include C:\Program Files\ProfileUnity\* or C:\Program Files\ProfileUnity\**. Refer to your AV vendor's documentation for the correct syntax.

Generate a Full Binary File List (Optional)

If your AV solution requires explicit file-level exclusions rather than folder-level ones, run the following PowerShell commands to generate a complete list of all .dll, .exe, .cab, and .sys files. Output is saved to the Desktop.

(Get-ChildItem -Recurse 'C:\Program Files\ProfileUnity\' -File -Include "*.dll","*.exe","*.cab","*.sys").FullName > $env:userprofile\Desktop\PU_DllExeCabSys_List.txt
(Get-ChildItem 'C:\Windows\System32\drivers\' -File cb*.sys).FullName >> $env:userprofile\Desktop\PU_DllExeCabSys_List.txt

The second command appends the currently installed ProfileUnity filter drivers to the same output file.

Filter Drivers by Version

Filter drivers in C:\Windows\System32\drivers\ vary by ProfileUnity version. Exclude the drivers that match your installed version:

ProfileUnity Version Filter Driver Files to Exclude
6.9.5 Latest C:\Windows\System32\drivers\cbfilter24.sys
C:\Windows\System32\drivers\cbregistry24.sys
C:\Windows\System32\drivers\cbprocess24.sys
6.8.7 R2 HF releases C:\Windows\System32\drivers\cbfilter24.sys
C:\Windows\System32\drivers\cbregistry24.sys
C:\Windows\System32\drivers\cbprocess24.sys
6.8.7 & 6.8.7 R2 C:\Windows\System32\drivers\cbfilter22.sys
C:\Windows\System32\drivers\cbregistry22.sys
C:\Windows\System32\drivers\cbprocess22.sys
6.8.5 & 6.8.6 C:\Windows\System32\drivers\cbfilter20.sys
C:\Windows\System32\drivers\cbregistry20.sys
C:\Windows\System32\drivers\cbregistry.sys
⚠️ Important
Filter driver filenames can change after a hotfix update. Always verify the active driver filenames using the PowerShell command above or by checking the ProfileUnity Hot Fix List.

Phase 2 — Network Shares, Temp Directories, and Mount Points

These exclusions cover network shares and runtime temp paths used during logon and application delivery.

ProfileUnity Network Share (Deployment Location)

The default deployment path is \\<domainname>\netlogon\profileunity\. To confirm your path, check the ProfileUnity Console under Administration > ProfileUnity Tools > Deployment Path.
Exclude the following files within the deployment share:

7z\x64\7z.exe
7z\x86\7z.exe
LwL.ProfileUnity.Client.Startup.exe
LwL.ProfileUnity.Client.Startup.Update.exe
LwL.ProfileUnity.Client.Logoff.exe

User Home Portability / VHDX Directories

Exclude the following path recursively, including these file types: *.7z, *.lou, *.lbr, *.vhd, *.vhdx, *.manifest:

\\profileserver\profiles\%username%\Portability\  (recursive)

DIA (Dynamic Application Installation) Software Storage

Exclude *.vhd and *.vhdx files in the DIA application share:

\\server\share\DIA_APPS\

System Temp Directories

C:\Windows\Temp\ProfileUnity
C:\ProgramData\Liquidware\  (recursive)

User Temp Directory

%TEMP%\ProfileUnity
💡 Tip
This directory can be redirected to a fixed path such as C:\PUTemp using the ProfileUnity ADM/ADMX GPO template, which simplifies AV exclusion configuration.

FlexApp Package and ProfileDisk Mount Directories

C:\F\  (recursive — 6.9.5)
C:\FADIA-T\  (recursive — 6.8.7 and earlier)
C:\ProfileDiskMounts\
C:\Users\ProfileDisk\

User Local Portability Manifest

%USERPROFILE%\ProfileUnity\  (recursive)

FlexApp Block-Level Cache (SMB Cache Mode / Cloud)

C:\DiskShadowData\

AV Product-Specific Guidance

⚠️ Disclaimer
The example files and attachments referenced below are provided as illustrative starting points only. They may not reflect your specific ProfileUnity version, environment configuration, or AV product version. Always use the exclusion paths documented in this article as the authoritative reference, and update any example configurations before deploying in your environment.

CrowdStrike

Rather than managing 600+ individual file exclusions, use the following simplified folder-level and file-level exclusion set recommended by Liquidware Support:

Exclusion Path Applies To
Program Files\ProfileUnity\** All versions
Windows\System32\drivers\cbfilter24.sys 6.9.5  Latest
Windows\System32\drivers\cbprocess24.sys 6.9.5
Windows\System32\drivers\cbregistry24.sys 6.9.5
Windows\System32\drivers\cbfilter24.sys 6.8.7 R2 HF releases
Windows\System32\drivers\cbprocess24.sys 6.8.7 R2 HF releases
Windows\System32\drivers\cbregistry24.sys 6.8.7 R2 HF releases
Windows\System32\drivers\cbfilter22.sys 6.8.7 & 6.8.7 R2
Windows\System32\drivers\cbprocess22.sys 6.8.7 & 6.8.7 R2
Windows\System32\drivers\cbregistry22.sys 6.8.7 & 6.8.7 R2

A full file-level exclusion list generated via the PowerShell commands above is available as an attachment: 695_DllExeCabSys_List_CrowdStrike.txt

Microsoft Defender

A GPO-based example of path exclusions for Windows Defender is available as a downloadable attachment: MS Defender.zip

If your organization uses Microsoft Defender for Endpoint (MDE), the Attack Surface Reduction (ASR) feature may block ProfileUnity from performing elevation operations. Configure ASR exclusions for ProfileUnity via the Microsoft 365 Defender portal.

Citrix VDA 7.1.4 and later
When using Citrix VDA 7.1.4 or later, also add C:\Windows\System32\vds.exe to the Defender trusted programs list.

Trend Micro Apex One (formerly OfficeScan)

Refer to the attached TrendMicro.zip for example exclusion configurations specific to Trend Micro Apex One.

ProfileUnity Console Server Paths

If AV is running on the ProfileUnity server itself, also exclude the following:

C:\Program Files (x86)\Liquidware Labs\ProfileUnity\  (and all subfolders)
C:\Program Files\MongoDB\  (and all subfolders)
Product ProfileUnity with FlexApp
Product Version 6.8.5 and later
Updated May 27, 2026

Related articles