# Antivirus Exclusion Recommendations

This document provides **recommended antivirus exclusion configurations** for environments where **SessionLimit Server and Agent components** are deployed.

SessionLimit enforces security policies such as **session control, login limitation, credential-based authentication, and optional multi-factor authentication (2FA)** by interacting with the Windows logon process, credential providers, registry policies, and runtime system events.

Due to this behavior, certain antivirus or endpoint protection solutions may incorrectly identify SessionLimit components as suspicious or may interfere with their normal operation.

These exclusions are provided to ensure:

* Reliable enforcement of SessionLimit security policies
* Proper execution of authentication and 2FA workflows
* Stable communication between SessionLimit components
* Prevention of false-positive detections and silent blocking

This document applies to the following SessionLimit components:

* SessionLimit Server Service
* SessionLimit Agent (Client & Server)
* SessionLimit Web / Management Console (IIS-based)
* Credential Provider and logon-related agent modules

Supported deployment models:

* All-in-One Server installation
* Distributed Server / Database / Agent architecture
* Agent deployment on Windows Servers and Windows Clients

### Supported Operating Systems

#### Server Operating Systems

* Windows Server 2016
* Windows Server 2019
* Windows Server 2022
* Windows Server 2025

#### Client Operating Systems

* Windows 10
* Windows 11

### Why Antivirus Exclusions Are Required

SessionLimit performs the following operations that may be affected by real-time antivirus scanning or behavioral protection modules:

* Integration with Windows Credential Provider framework
* Logon, unlock, and RDP session interception
* Real-time policy evaluation during authentication
* Registry access under **HKLM** and **HKCU (SID-based)** paths
* Local runtime decision-making for login and 2FA enforcement
* Secure communication between Agent, Server, and Directory Services

Aggressive antivirus scanning, ransomware protection, or behavioral monitoring may:

* Delay or block authentication flows
* Prevent 2FA prompts from appearing
* Disable session limitation enforcement
* Cause inconsistent or undefined security behavior

For these reasons, controlled and limited exclusions are recommended.

### Recommended File-Based Exclusions

The following **executable files** should be excluded individually from real-time antivirus scanning.

#### Agent Components

<table><thead><tr><th width="106">Type</th><th>Path</th></tr></thead><tbody><tr><td>File</td><td><code>C:\Program Files\SessionLimit v2\SessionLimitService.exe</code></td></tr><tr><td>File</td><td><code>C:\Program Files\SessionLimit v2\SessionLimitUI.exe</code></td></tr><tr><td>File</td><td><code>C:\Program Files\SessionLimit v2\Settings\SessionLimit.LanguageSettings.exe</code></td></tr></tbody></table>

#### Server Components

<table><thead><tr><th width="82">Type</th><th>Path</th></tr></thead><tbody><tr><td>File</td><td><code>C:\Program Files\SessionLimit Server 2.0\Service\SessionLimitServerService.exe</code></td></tr><tr><td>File</td><td><code>C:\Program Files\SessionLimit Server 2.0\FTW\FTW.exe</code></td></tr></tbody></table>

### Data and Runtime Folder Exclusions

The following directory contains runtime data, cache, and operational files used by SessionLimit:

<table><thead><tr><th width="122">Type</th><th>Path</th></tr></thead><tbody><tr><td>Folder</td><td><code>C:\ProgramData\ArkSoft\SessionLimit20\*.*</code></td></tr></tbody></table>

### Process-Based Exclusions

In addition to file exclusions, **process-based exclusions** are recommended to prevent behavioral blocking.

<table><thead><tr><th width="146">Component</th><th>Process Name</th></tr></thead><tbody><tr><td>Agent</td><td><code>SessionLimitService.exe</code></td></tr><tr><td>Agent</td><td><code>SessionLimitUI.exe</code></td></tr><tr><td>Agent</td><td><code>SessionLimit.LanguageSettings.exe</code></td></tr><tr><td>Server</td><td><code>SessionLimitServerService.exe</code></td></tr><tr><td>Server</td><td><code>FTW.exe</code></td></tr></tbody></table>

### Registry Access Considerations

SessionLimit uses the Windows Registry to store configuration, policy, and runtime information.

#### HKLM (Machine-Level)

| Path                                                                  |
| --------------------------------------------------------------------- |
| `HKEY_LOCAL_MACHINE\SOFTWARE\Arksoft Bilisim\SessionLimit v2`         |
| `HKEY_LOCAL_MACHINE\SOFTWARE\Arksoft Bilisim\SessionLimit Server 2.0` |
| `HKEY_LOCAL_MACHINE\SOFTWARE\Arksoft Bilisim\Settings\{GUID}`         |

#### HKCU / SID-Based (Agent)

| Path                                                                                    |
| --------------------------------------------------------------------------------------- |
| `HKEY_USERS\<UserSID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System`        |
| `HKEY_USERS\<UserSID>\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI` |

> Registry exclusions should be evaluated and approved according to the organization’s security policy.

### Network and Behavioral Protection Considerations

#### Network Communication

SessionLimit relies on the following network communications:

| Source | Destination           | Protocol / Port                 |
| ------ | --------------------- | ------------------------------- |
| Agent  | SessionLimit Server   | TCP 443 (HTTPS)                 |
| Server | Microsoft SQL Server  | TCP 1433                        |
| Server | Microsoft SQL Browser | UDP 1434                        |
| Server | Active Directory      | TCP/UDP 389 (LDAP)              |
| Server | Active Directory      | TCP 636 (LDAPS, if enabled)     |
| Server | Global Catalog        | TCP 3268 / 3269 (if applicable) |
| Server | DNS                   | TCP/UDP 53                      |

#### Behavioral / Ransomware Protection

SessionLimit Agent may interact with the Windows logon process via supported Credential Provider mechanisms.\
Behavioral protection or ransomware prevention modules should allow these operations to avoid:

* Blocked login flows
* Missing 2FA challenges
* Partial or failed policy enforcement

SessionLimit does **not** perform undocumented code injection or unauthorized memory manipulation.

### Security Notice and Disclaimer

* The exclusions listed in this document are **recommendations only**.
* Final implementation decisions remain the responsibility of the customer’s system and security administrators.
* Failure to apply appropriate exclusions may result in:
  * Incomplete or failed authentication workflows
  * 2FA mechanisms not triggering as expected
  * Session limitation policies not being enforced
* In such cases, SessionLimit may not be able to guarantee expected security behavior.