Scanning on Windows with EDR or antivirus

View as Markdown

Can EDR or antivirus software interfere with Windows Explorer or CLI scans?

Yes. Some EDR, antivirus, HIDS, and endpoint protection products on Windows can interfere with runZero Explorer and CLI scanner operations. Common symptoms are blocked packet capture, failed raw socket operations, unstable scan behavior, and process termination.

To reduce or resolve these issues:

  1. Add allowlist exceptions for the runZero binaries, services, and directories the Explorer or CLI scanner uses.
  2. Check that endpoint security policies aren’t blocking packet capture components (including npcap/winpcap where applicable).
  3. If your endpoint tooling supports policy modes, use a monitoring-only mode while validating scan operations.
  4. In some environments, you may need to temporarily disable endpoint protection controls on the host to confirm whether they are the root cause.
  5. Re-run the scan, or reinstall or restart the Explorer, after policy updates.

If issues continue, collect Explorer diagnostics or CLI output and contact runZero support.

Updated