Next in our series: how to enable scanning of reparse points, also known as junctions, or mount points.
(For more information about what exactly reparse points, junctions and mount points are, see http://msdn.microsoft.com/en-us/library/aa365006(VS.85).aspx and http://msdn.microsoft.com/en-us/library/aa365503(VS.85).aspx)
Out of box, FCS does not scan reparse points. However, there is a registry key that you can add to your environment to control this behavior. As in the first post of this series (http://blogs.technet.com/clientsecurity/archive/2010/01/29/scanning-removable-drives.aspx), you must use either an ADM file via Group Policy or a .reg file to add the key.
Some important notes about this setting:
· The FCS custom scan interface honors this setting. That is, if you have added this key, and have it set to 1 (or the setting is missing), then the custom scan interface does not even display the mount points.
· You should test this setting before deploying it in your organization. It is possible to have junctions that link back to themselves – in a circular fashion. If you have such in your environment, you may see scans that never finish, or never complete successfully, after enabling this setting.
The key name is DisableReparsePointScanning, and has two possible settings:
· Missing or 1: Reparse points are not included in full scans.
· 0 (zero): Reparse points are included in full scans.
For the ADM file, start Notepad, and then copy and paste the following text into the Notepad file:
CLASS MACHINE
CATEGORY !!FCSCategory
POLICY !!ReparsePointScanning_Name
KEYNAME "SOFTWARE\Policies\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Scan"
EXPLAIN !!ReparsePointScanning_Explain
;; Note that instead of disabling a disable we flip-flop the logic to make it proactive
VALUENAME DisableReparsePointScanning
VALUEON NUMERIC 0
VALUEOFF NUMERIC 1
END POLICY
END CATEGORY
[strings]
FCSCategory="Microsoft FCS Reparse Point Scanning"
ReparsePointScanning_Name="Enable reparse point scanning"
ReparsePointScanning_Explain="This setting instructs the FCS antimalware client to scan reparse points during full scans."
Save the file as an ADM file, making sure to choose All files *.* as the file type (the KB suggests saving it with the KB ID number – for this one, you could use ReparsePoint.ADM as the file name), and then use Group Policy to deploy the new setting, as described in Option 1, step 2, in the KB article.
If you want to deploy the DisableReparsePointScanning key via a .reg file, follow the steps described in Option 2 in the KB article, substituting the following registry information for step 4:
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Microsoft Forefront\Client Security\1.0\AM\Scan]
"DisableReparsePointScanning"=dword:0
