Antivirus and Endpoint Security Exclusions

What is this?

Margin Master replaces its own program files every time it updates, and it writes logs and settings outside the program folder while it runs. Antivirus and endpoint-protection software watches for exactly that pattern, so it sometimes gets in the way — not because anything is wrong, but because "a program rewriting itself" is a shape worth looking at.

Give this page to whoever manages security software on the store's PCs. The exclusions below are the complete set; adding them prevents the whole class of problem, and none of them weaken protection for anything other than Margin Master's own files.

Margin Master is digitally signed by RetailerSoft. If your security console offers a publisher-based or certificate-based exclusion, that is the cleanest option of all and it covers every path below automatically.

Folder and file exclusions

Add these to the exclusion, allow, or "do not scan" list.

How to find the install folder

If you are not sure which of the two locations is in use, right-click the Margin Master shortcut, choose Open file location, and go up one folder from the one you land in. The folder that contains Update.exe and a current folder is the one to exclude.

Process exclusions

Where the security product distinguishes processes from files, exclude these as well:

• MarginMaster.exe — the application
• Update.exe — the updater
• MarginMaster.BackgroundService.exe — the background service, if the store uses it

HTTPS inspection

Many endpoint products inspect encrypted web traffic by decrypting and re-encrypting it. When that inspection sits in front of a large download it can slow it to a stop rather than block it outright, which looks like Margin Master hanging rather than an error anyone can see.

Exempt these hosts from HTTPS / deep packet inspection:

• www.marginmaster.com
• retailersoft.blob.core.windows.net
• marginmaster.blob.core.windows.net

These are the same hosts the firewall needs to allow. The full list of hosts and ports, with what each is used for, is in Firewall and Network Requirements.

SonicWall Capture Client and SentinelOne

Epicor supplies SonicWall Capture Client to many stores as part of its standard security package. Capture Client is built on SentinelOne, so alerts appear under the SentinelOne name even though the product was installed by Epicor.

To add the exclusions, open the Capture Client console, go to Policies, and add each folder above under the policy's exclusion list. On a store PC where the console is managed by Epicor, the exclusions have to be added by whoever administers that tenant — Epicor support can do it.

To check whether it has actually blocked something, open the Capture Client dashboard and look at Threat History. Two things are worth knowing before you read it:

• An entry that says Risk Mitigated with 0 quarantined files means nothing was removed.
• A path under C:\Config.Msi\ ending in .rbf is a Windows Installer file. Margin Master does not use Windows Installer, so entries like that come from something else on the PC — a Windows Update, the .NET runtime installer, or Epicor's own software — and are unrelated to Margin Master even when the timing looks suggestive.

If Threat History shows nothing for the time Margin Master had trouble, security software was not what stopped it, and the problem is worth reporting so the real cause can be found.

Tips

Add the exclusions before rolling Margin Master out to a new PC. Doing it up front costs a minute; doing it after a quarantine means repairing the installation as well.

If an update repeatedly gets partway and never finishes, and the exclusions are in place, see Automatic Updates & Snooze Options, which covers the other reasons an update cannot complete.

Common Questions

Q: Does adding these exclusions make the PC less safe? A: Only for Margin Master's own files, which are digitally signed by RetailerSoft. Everything else on the machine is still scanned normally.

Q: My security software quarantined a Margin Master file. What now? A: Restore it from the quarantine list, then add the exclusions so it does not happen again. If Margin Master will not start afterwards, reinstall it from the installer — a restored file is sometimes returned in a state the program cannot use.

Q: Margin Master says it updated, but the version never changes. A: Something is holding the program folder open, and security software is the usual cause. Add the exclusions above. Automatic Updates & Snooze Options covers the built-in recovery options.

Q: Do I need these on every PC, or only the one that runs the updates? A: Every PC that runs Margin Master. Each one updates itself independently.

Q: We use Windows Defender rather than a third-party product. Do these still apply? A: Yes. The same folders apply; add them under Virus & threat protection > Manage settings > Exclusions.