# Ansible inaccessible due to Cisco Secure Endpoint antivirus

**URL:** <https://forum.ansible.com/t/ansible-inaccessible-due-to-cisco-secure-endpoint-antivirus/37513>\
**Category:** Ansible Project\
**Created:** [January 3, 2023, 7:58am UTC](https://forum.ansible.com/t/ansible-inaccessible-due-to-cisco-secure-endpoint-antivirus/37513 "2023-01-03T07:58:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joelle\_Boillat](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@Joelle\_Boillat](https://forum.ansible.com/u/Joelle_Boillat)\
**Post date:** [January 3, 2023, 7:58am UTC](https://forum.ansible.com/t/ansible-inaccessible-due-to-cisco-secure-endpoint-antivirus/37513/1 "2023-01-03T07:58:15Z")

</div>

Good Morning,

At the beginning of December I can’t reach a server from a client. This is due to Cisco Secure Endpoint.

So I want to create an exclusion for this specific server.

Can anyone help me on what to exclude from the antivirus to make it work again ?

The first thing I did it’s to allow the process 59d3cdc7d51fa34c6b27b8b04ea17992955466eb25022b7bd64880ab35df0bbc but it’s always impossible to access to the server. You will find the error here attached.

I have created the following exclusions but it doesn’t work :

- IOC : [W32.CscriptRemoteSystemScript.ioc](https://console.eu.amp.cisco.com/indicators?search=W32.CscriptRemoteSystemScript.ioc)
- Process : 59d3cdc7d51fa34c6b27b8b04ea17992955466eb25022b7bd64880ab35df0bbc
- Executable : cscript.exe

Someone could help me please ?

Many thanks in advance for your help.

Kind regards,  
Joëlle

 ![AMP_Exclusion_Ansible.PNG](https://us1.discourse-cdn.com/ansible/original/2X/7/70826d5ee09585462cd174710c1b1b5859466a76.png) ![Ansible_Error_Access.png](https://us1.discourse-cdn.com/ansible/original/2X/d/d49936aaf51cc2801a532e065d8d29fc0bf94449.png)

---

<div class="post-metadata">

**Author:** ![Mike\_Eggleston](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@Mike\_Eggleston](https://forum.ansible.com/u/Mike_Eggleston)\
**Post date:** [January 3, 2023, 12:52pm UTC](https://forum.ansible.com/t/ansible-inaccessible-due-to-cisco-secure-endpoint-antivirus/37513/2 "2023-01-03T12:52:17Z")

</div>

Modify your inventory list removing the device…?

Mike

---

<div class="post-metadata">

**Author:** ![Joelle\_Boillat](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@Joelle\_Boillat](https://forum.ansible.com/u/Joelle_Boillat)\
**Post date:** [January 3, 2023, 3:39pm UTC](https://forum.ansible.com/t/ansible-inaccessible-due-to-cisco-secure-endpoint-antivirus/37513/3 "2023-01-03T15:39:56Z")

</div>

Hello Mike,

I want that the server will be always protected by Cisco Secure Endpoint.

I need to know what needs to be excluded from the antivirus so that Ansible can continue to work.

Thank you !  
Joëlle