This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 21%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESW%3C/text%3E%3C/svg%3E)
Hi all,
I'm having some issues with Storage Replica not playing nicely with Mcafee ENS on two 2016 servers. They're set up as a failover cluster with a disk on each server set up to replicate using Storage Replica. With the ENS on-access scan disable I can run "Sync-SRGroup -Name $srgroup_name" from PowerShell and the two disks will find each other and quickly say "Continuously replicating" as their status. With the on-access scan enabled if I run Sync-SRGroup the disks will stay on "ConnectingToSource"/"WaitingForDestination" indefinitely. Having spoken to Mcafee support they say that we need to configure additional exclusions for on-access scan however they weren't able to tell me what those exclusions actually were. I've added those recommended in this article: https://learn.microsoft.com/en-GB/troubleshoot/windows-server/high-availability/not-cluster-aware-antivirus-software-cause-issue, (essentially just %Systemroot%\Cluster as the quorum is not on a locally attached disk and we're not using a cluster service account) but this doesn't appear to be enough to get it working.
Has anyone else had similar issues with Storage Replica and antivirus?
Hi,
Thanks for posting on our forum!
From our perspective, we can provide you with some guidance on configuring antivirus exclusions for storage replica in a cluster service if you use Windows Defender as well. However, after my research, Mcafee ENS is a security application so I am not sure if you should also configure exclusions from this app as well:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-exclusions-microsoft-defender-antivirus?view=o365-worldwide
In terms of VSB script, we may not be able to offer any help as it is beyond our scope. However, you can go to Github.com to ask for help.
Thanks for your support and understanding! Besides, if you think my answer is helpful, would you please help me Accept Answer. An accepted blog can be put on top of our forum, so that people who have a similar issue can get access to their solution more quickly.
BR,
Joan
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(304, 72%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYM%3C/text%3E%3C/svg%3E)
Hi , we are the same problem on my company with mcafee agent the replication stuck to (waiting destination) when we disconnect mcafee agent , the replication pass to "continous replicating".
SimonWalker-5942 have you find a solution since 2 month ?
Thanks in advance for your help.
Nothing yet I'm afraid. I'm in touch with Mcafee support though so if they ever find a fix I'll post it here.
Oh , and there are nothing on the web , we will open a case MS , maybe they have an idea for that. if we have a solution we will post here too.
thank you
Hello , I don't know if you have find a solution , but we have solve this problem with Mcafee , it must to put "SYSTEM" on process in low risk on the on access configuration. After that we don't have the "connecting to source/ waiting to destination"
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 92%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVV%3C/text%3E%3C/svg%3E)
Hi @YOUNSI, Menad - Was this recommended by Mcafee? We also face the same problem. I cannot understand the solution. Add "SYSTEM" and set the process type to "Low Risk" in the ON-Access scan.
Is this what you trying to say?
Hello,
In fact, from your EPO admin console, go to strategy catalog ==> Endpoint Security Threat Prevention ==> on-access scan ==> choose the strategy where your servers are located and click modify
and in the process parameters ==> "check Configure different settings for high risk and low risk processes" and ADD the process "SYSTEM" only that in low risk process.
After A little lower check "Do not scan while reading from disk or writing to disk" in low risk and SAVE the configuration.
To finish you can force the strategy to your servers on "system tree" ==> select your servers and "reactivate agent" don't forget to check "Force full update of policies and tasks" and click OK. After test to failover your cluster resource and check if its still stuck on "waiting destination, connect to source ".
For us to solve the problem, I hope I was clear enough, I apologize in advance for my bad English.
Any update related to this case? Im facing the issue.