TAO antivirus and EDR exclusions
Recommended folder, process, and service exclusions so third-party AV/EDR agents do not quarantine or block Trustity TAO.
TAO antivirus and EDR exclusions
Many customers run Trustity TAO alongside another endpoint security product (Microsoft Defender, CrowdStrike, SentinelOne, and others). Those products are complementary. They also scan and sometimes quarantine new privileged agents.
If AV/EDR blocks TAO, symptoms look like enrollment failure, offline devices, missing inventory, VisionX not starting, or Setup that never finishes. Apply exclusions before broad rollout whenever your security stack is aggressive.
Scope
This article is the canonical exclusion list for TAO on Windows and Linux. Vendor-specific console steps live in the linked guides below. It does not cover GenGuard browser force-install (see Deploy GenGuard) or HostGuard IPS thresholds (HostGuard has no process allowlist - see thresholds and allowlists).
ZeroDevice / device-control exclusions are not published here while that capability remains internal.
Windows - what to exclude
Apply path exclusions at minimum. Add process and service exclusions when your EDR supports them.
Paths
| Path | Why |
|---|---|
C:\Program Files\Trustity\TAO\ | Install directory for agent binaries |
%ProgramData%\Trustity\TAO\ | Enrollment, policy cache, logs, update state |
%ProgramData%\Trustity\ | Portal CA file and shared Trustity data (especially TCP On-Prem) |
If your console does not expand environment variables, also add the resolved path under C:\ProgramData\Trustity\.
Processes
| Process | Role |
|---|---|
tao-agent.exe | Service / privileged agent |
tao-gui.exe | Interactive agent UI |
tao-tray.exe | Tray status |
tao-lock.exe | VisionX lock experience |
tao-zerodevice.exe | Device-control helper (when entitled / enabled) |
Trustity-Agent-Setup.exe | Installer / silent update payload |
Full paths are typically under C:\Program Files\Trustity\TAO\ except Setup, which you download from Deployment.
Service
| Service name | Display name (typical) |
|---|---|
TrustityAgent | Trustity Agent |
Allow start/stop and image-path changes during approved updates. Do not require interactive approval for the service to start at boot.
Linux - what to exclude
| Item | Value |
|---|---|
| Binary / unit install path | Follow your package layout after ./install.sh (commonly under /usr/local or /opt as shipped) |
| State directory | /var/lib/trustity/tao/ |
| Service unit | trustity-tao.service |
| Process / CLI | tao-agent |
Exclude the state directory from real-time malware scan when your Linux EDR supports path exclusions. Do not exclude the entire /var tree.
Network (not an AV exclusion)
AV exclusions do not replace firewall allowlists. TAO still needs outbound HTTPS as described in Network requirements (cloud) or your TCP On-Prem portal hostname (air-gap).
Rollout order
- Add exclusions in the AV/EDR console (or group policy) for the pilot OU / device group.
- Confirm the policy reached the endpoint.
- Install or upgrade TAO from Cloud Portal → Deployment.
- Verify
sc query TrustityAgent(Windows) orsudo systemctl status trustity-tao(Linux). - Confirm Managed devices shows Online and the expected version.
If you install first and exclude later, check the AV quarantine / detections console and restore any Trustity files before retrying.
Vendor guides
- Microsoft Defender exclusions for TAO
- CrowdStrike Falcon exclusions for TAO
- SentinelOne exclusions for TAO
- Other EDR and antivirus products
What not to do
- Do not disable the corporate AV/EDR product to "make TAO work".
- Do not exclude all of
C:\Program Filesor all of%ProgramData%. - Do not paste organization license keys into EDR tickets or exclusion notes.
- Do not treat a green MDM install as proof of enrollment - still verify portal Online status.