Deleting files

You can use procmon.exe (downloadable from Microsoft) to monitor for processes accessing files in that location and see if you can identify any strange activity

Tip for procmon use - set the backing file location so that it logs properly to a file (and a voluem with enough disk space) and make sure you restart procmon.exe after setting up teh backing file so that activity can be monitored (and logged)

Thanks CraigV. That TN did not come up in my original searches. I pulled it up and followed it. Strange thing is, once I add the folders to the exclusion list, close the McAfee console and then go back into the console, those exclusions are no longer listed. Also, shortly after following the TN you provided, I got the warning again.

Not that I would know much about McAfee but is it being mangaed by some kind of centralised process or policy control as changing it locally might get overwritten if it is.

Yeah McAfee's ePO server can overwrite any policies from a central location. Had this happen to me plenty of times. Check that as Colin said and try the exclusion from there.

Thanks!

Thanks Colin. McAfee wasn't supposed to be managed and I didn't think it was, but at your suggestion I decided to look at it anyway. Don't you know it's the smallest things that trip us up at times. It was being managed by the ePo. It has been removed from a managed state, exclusions have been added and retained. Will monitor for the deletion activity for a couple of days and update the thread.

The issue does appear to be resolved. Admins may close this thread.