Antivirus Exclusions for Atlas Reach

The paths and folders to allow-list in Microsoft Defender or another antivirus / EDR so the Atlas Reach agent is not quarantined, on Windows, macOS and Linux.

Before you begin

  • Rights to change the policy of your antivirus / EDR (Microsoft Defender via Intune, Group Policy, or Defender for Endpoint; or your third-party product's console)
  • The Atlas Reach agent installed as described in Install the Atlas Reach Agent on Windows, on macOS, or on Linux

Windows: the managed agent (AtlasAvdAgent.msi)

The agent MSI installs a single self-contained executable and registers it as the AtlasAvdAgent service (display name "Atlas AVD Endpoint Agent", running as LocalSystem). The same executable relaunches itself for the screen-capture, clipboard, chat, annotation, and session-banner helpers in the user's session, so one process exclusion covers all of them.

  • Executable (file and process exclusion): C:\Program Files\Atlas AVD\Agent\AtlasAvdAgent.exe
  • Service name: AtlasAvdAgent
  • Data folder (logs, device credential, and staged updates): C:\ProgramData\AtlasAVD\Agent
  • The x64, x86, and ARM64 builds all install to the Program Files folder of the matching architecture, under Atlas AVD\Agent.

If the agent was installed with the interactive wizard and a different install folder was chosen, use that folder instead of C:\Program Files\Atlas AVD. Agent updates are downloaded to C:\ProgramData\AtlasAVD\Agent\updates and checked against a SHA-256 hash before they are installed.

Windows: Quick Support (attended sessions)

Quick Support runs the same agent executable as the signed-in user, with no service and no admin rights. It is delivered either as a per-user MSI that removes itself when the session ends, or as a standalone executable that runs directly from the user's Downloads folder. The support link is part of the downloaded file name, so allow-list by the name pattern rather than one exact file name.

  • Installed by the Quick Support MSI: %LocalAppData%\Atlas AVD\Reach Quick Support\AtlasAvdAgent.exe (in a machine-wide policy: C:\Users\*\AppData\Local\Atlas AVD\Reach Quick Support\AtlasAvdAgent.exe, because Defender does not expand per-user variables such as %LocalAppData%)
  • Standalone download: AtlasReachQuickSupport*.exe (for example %UserProfile%\Downloads\AtlasReachQuickSupport.<token>.exe)
  • MSI download: AtlasReachQuickSupport*.msi

SmartScreen and Defender trust the signed Quick Support MSI more readily than the standalone executable, so send customers the MSI where you can. It needs no exclusion in most environments.

Windows: adding the exclusions in Microsoft Defender

On a single host, run these from an elevated PowerShell prompt. For a fleet, add the same paths to an Intune Antivirus policy (Microsoft Defender Antivirus exclusions) or the Group Policy setting Windows Components → Microsoft Defender Antivirus → Exclusions.

# Managed agent
Add-MpPreference -ExclusionPath    "C:\Program Files\Atlas AVD\Agent\AtlasAvdAgent.exe"
Add-MpPreference -ExclusionProcess "C:\Program Files\Atlas AVD\Agent\AtlasAvdAgent.exe"
Add-MpPreference -ExclusionPath    "C:\ProgramData\AtlasAVD\Agent"

# Quick Support (per-user MSI install, any user profile)
Add-MpPreference -ExclusionProcess "C:\Users\*\AppData\Local\Atlas AVD\Reach Quick Support\AtlasAvdAgent.exe"

# Check what is applied
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess

Defender for Endpoint's attack surface reduction (ASR) rules and tamper protection are managed separately from antivirus exclusions. If an ASR rule blocks the agent, add the same executable path as an ASR exclusion ("Attack Surface Reduction Only Exclusions") in your Intune or Defender for Endpoint policy.

macOS

The macOS .pkg installs a launchd daemon. Allow-list the binary in your EDR, and if you use a PPPC profile for Screen Recording and Accessibility, target the same binary.

  • Executable: /usr/local/atlas-reach-agent/atlas-reach-agent
  • Launch daemon: /Library/LaunchDaemons/com.atlasavd.reach-agent.plist (label com.atlasavd.reach-agent)
  • Config and state: /Library/Application Support/AtlasAVD/ReachAgent
  • Logs: /Library/Logs/AtlasAVD

Linux

The .deb and .rpm packages install a systemd service. Allow-list the binary in your EDR (for example CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint on Linux).

  • Executable: /usr/lib/atlas-reach-agent/atlas-reach-agent
  • systemd unit: atlas-reach-agent.service
  • Config: /etc/atlas-reach-agent
  • State: /var/lib/atlas-reach-agent

What not to exclude

These locations hold content that comes from outside the device. Leave them scanned so your antivirus still inspects everything an operator sends:

  • The file-transfer inbox: C:\Users\Public\Downloads\AtlasReach on Windows, /Users/Shared/AtlasReach on macOS, and /var/tmp/AtlasReach on Linux.
  • Temporary scripts, checks, and software installers the agent runs (atlas-reach-*.ps1, .cmd, .msi, and .exe files in the system temp folder). PowerShell scripts are also still inspected by AMSI.
  • Broad folder exclusions such as all of C:\Program Files or C:\ProgramData.

Still blocked after adding exclusions? Check your antivirus or EDR console for the detection name and the blocked path, and send them to support@atlasavd.com with the agent version shown on the Devices tab of Atlas Reach.

Next steps