Recommended Folder exclusions for Windows antivirus programs on Exchange 2016 servers

Exclude the following folders from file-level scanning and memory-resident scanning on Exchange 2016 servers.

FolderCategoryDescriptionServers
%SystemRoot%\ClusterDAGsThe cluster quorum database and other files for database availability groups (DAGs).Mailbox servers
%SystemDrive%\DAGFileShareWitnesses\ DAGsThe witness directory on the witness server that's configured for the DAG. The witness server can be virtually any Microsoft Windows server in the local Active Directory forest that isn't already a member of the DAG.To see the actual location, run the following command: Get-DatabaseAvailabilityGroup Format-List WitnessAny
%ExchangeInstallPath%ClientAccess\OABOffline Address BooksOffline Address Book files.Mailbox servers
%ExchangeInstallPath%FIP-FSAntimalware and DLPContent scanning that's used by the Malware agent and data loss prevention (DLP).Mailbox servers
%ExchangeInstallPath%GroupMetricsMailTipsGroup Metrics files that are used to calculate values for the Large Audience and External Recipients MailTips.Mailbox servers
%ExchangeInstallPath%LoggingExchange process logsThis folder contains many different types of Exchange logs in subfolders. For example:Calendar Repair Assistant logsManaged Folder Assistant logsIMAP4 protocol logsPOP3 protocol logsTo see the actual locations, run the following commands: Get-MailboxServer -Server **Format-List LogPath Get-PopSettings Format-List LogFileLocation Get-ImapSettings Format-List LogFileLocation
%ExchangeInstallPath%MailboxMailbox databasesExchange databases, checkpoint files, and log files. By default, these files are located in subfolders based on the name of the database. To see the actual locations, run the following command: Get-MailboxDatabase -Server Format-List EdbFilePath,LogFolderPath By default, database context index files are located in the same folder as the database files in a subfolder that's named after the GUID of the database.Mailbox servers
%ExchangeInstallPath%TransportRoles\Data\AdamEdgeSyncActive Directory Lightweight Directory Services (AD LDS) and log files.Edge Transport servers
%ExchangeInstallPath%TransportRoles\Data\IpFilterConnection filteringIP filter database, checkpoint, and log files.Edge Transport servers
%ExchangeInstallPath%TransportRoles\Data\QueueQueuesQueue database, checkpoint, and log files.Mailbox serversEdge Transport servers
%ExchangeInstallPath%TransportRoles\Data\SenderReputationSender reputationSender Reputation database, checkpoint, and log files.Edge Transport serversMailbox servers
%ExchangeInstallPath%TransportRoles\Data\TempContent conversionContent conversion that's done in the transport pipeline.Mailbox serversEdge Transport servers
%ExchangeInstallPath%TransportRoles\LogsTransport logsMail flow and transport pipeline logs are located in subfolders, for example:Agent loggingConnectivity loggingMessage trackingPipeline tracingSend and Receive connector protocol loggingTo see the actual locations, run the following commands: Get-TransportService Format-List LogPath,TracingPath Get-FrontEndTransportService **Format-List *LogPath Get-MailboxTransportService **Format-List LogPath,TracingPathMailbox serversEdge Transport servers (Transport service only)
%ExchangeInstallPath%TransportRoles\PickupPickup directoryThe Pickup directory is used by administrators for mail flow testing or by applications that need to create and submit their own message files.To see the actual location, run the following command: Get-TransportService Format-List PickupDirectoryPathMailbox serversEdge Transport servers
%ExchangeInstallPath%TransportRoles\ReplayReplay directoryThe Replay directory receives messages from foreign gateway servers and can also be used to resubmit messages that administrators export from the queues of Exchange servers.To see the actual location, run the following command: Get-TransportService Format-List ReplayDirectoryPathMailbox serversEdge Transport servers
%ExchangeInstallPath%UnifiedMessaging\GrammarsUnified MessagingGrammar files for different locales, for example en-EN or es-ES.Mailbox servers
%ExchangeInstallPath%UnifiedMessaging\PromptsUnified MessagingVoice prompts, greetings, and informational message files.Mailbox servers
%ExchangeInstallPath%UnifiedMessaging\TempUnified MessagingTemporary files generated by Unified Messaging.Mailbox servers
%ExchangeInstallPath%UnifiedMessaging\VoicemailUnified MessagingVoice mail files that are temporarily stored.Mailbox servers
%ExchangeInstallPath%Working\OleConverterContent conversionTransport Neutral Encoding Format (TNEF), also known as Rich Text Format (RTF), to MIME/HTML conversions.Mailbox serversEdge Transport servers
%SystemDrive%\inetpub\temp\IIS Temporary Compressed FilesWeb componentsInternet Information Services (IIS) compression folder that's used with Outlook on the web.Mailbox servers
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET FilesWeb componentsTemporary files that are used with Exchange services. These files are located in the following subfolders:autodiscoverecpewsmapimapi_emsmdbmicrosoft-server-activesyncoabowaowa_calendarpowershellrootrpcMailbox servers
%SystemRoot%\System32\InetsrvWeb componentsIIS system files.Mailbox servers
%SystemRoot%\Temp\OICE_ ** \Exchange SearchTemporary files used by the Exchange Search service and Microsoft Filter Pack to perform file conversion in a sandboxed environment.Mailbox servers
REF:https://technet.microsoft.com/en-us/library/bb332342(v=exchg.160).aspx#Folder