Repository: microsoft/CSS-Exchange
File: Diagnostics/AVTester/Test-ExchAVExclusions.ps1 (PowerShell)

Code before:
$ModuleAllowList.add("SCCXT.DLL")
# cSpell:enable

Write-SimpleLogFile -string ("Allow List Module Count: " + $ModuleAllowList.count) -Name $LogFile

$UnexpectedModuleFound = 0

"`n####################################################################################################" | Out-File $OutputProcessPath
"$((Get-Date).ToString())" | Out-File $OutputProcessPath -Append
"####################################################################################################" | Out-File $OutputProcessPath -Append

$showWarning = $false
# Gather each process and work thru their module list to remove any known modules.
foreach ($process in $ServerProcess) {

    # Determine if it is a known exchange process
    if ($ProcessList -contains $process.path ) {

        # Gather all modules
        [array]$ProcessModules = $process.modules

        # Remove Microsoft modules
        $ProcessModules = $ProcessModules | Where-Object { $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation." -and $_.FileVersionInfo.CompanyName -ne "Microsoft" -and $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation" }

        # Generate and output path for an Non-Default modules file:
        $OutputProcessPath = Join-Path $env:LOCALAPPDATA NonDefaultModules.txt

        # Clear out modules from the allow list
        foreach ($module in $ModuleAllowList) {
            $ProcessModules = $ProcessModules | Where-Object { $_.ModuleName -ne $module -and $_.ModuleName -ne $($module.Replace(".dll", ".ni.dll")) }
        }

        if ($ProcessModules.count -gt 0) {
            Write-Warning ("Possible AV Modules found in process $($process.ProcessName)")
            $UnexpectedModuleFound++
            foreach ($module in $ProcessModules) {
                if ( $process.MainModule.ModuleName -eq "W3wp.exe" -and $showWarning -eq $false) {
                    Write-Warning "W3wp.exe is not present in the recommended Exclusion list but we found 3rd Party modules on it and could affect Exchange performance."
                    Write-SimpleLogFile -string "W3wp.exe is not present in the recommended Exclusion list but we found 3rd Party modules on it and could affect Exchange performance." -name $LogFile
                    $showWarning = $true
                }
                $OutString = ("[FAIL] - PROCESS: $($process.ProcessName) PID($($process.Id)) MODULE: $($module.ModuleName) COMPANY: $($module.Company)`n`t $($module.FileName)")
                Write-SimpleLogFile -string $OutString -Name $LogFile -OutHost
                $OutString | Out-File $OutputProcessPath -Append
            }
        }
    }
}

# Final output for process detection
if ($UnexpectedModuleFound -gt 0) {

Review comment (suggestion):
you currently have these that will not convert.

```
$ModuleAllowList.add("SCCOLE2.DLL")
$ModuleAllowList.add("SCCSD.DLL")
$ModuleAllowList.add("SCCXT.DLL")
```

Code after:
$ModuleAllowList.add("SCCXT.dll")
# cSpell:enable

Write-SimpleLogFile -string ("Allow List Module Count: " + $ModuleAllowList.count) -Name $LogFile

$UnexpectedModuleFound = 0
$showWarning = $false

# Gather each process and work thru their module list to remove any known modules.
foreach ($process in $ServerProcess) {

    # Determine if it is a known exchange process
    if ($ProcessList -contains $process.path ) {

        # Gather all modules
        [array]$ProcessModules = $process.modules

        # Remove Microsoft modules
        $ProcessModules = $ProcessModules | Where-Object { $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation." -and $_.FileVersionInfo.CompanyName -ne "Microsoft" -and $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation" }

        # Generate and output path for an Non-Default modules file:
        $OutputProcessPath = Join-Path $env:LOCALAPPDATA NonDefaultModules.txt

        # Clear out modules from the allow list
        foreach ($module in $ModuleAllowList) {
            $ProcessModules = $ProcessModules | Where-Object { $_.ModuleName -ne $module -and $_.ModuleName -ne $($module.Replace(".dll", ".ni.dll")) }
        }

        if ($ProcessModules.count -gt 0) {
            if ($UnexpectedModuleFound -eq 0) {
                "`n####################################################################################################" | Out-File $OutputProcessPath  -Append
                "$((Get-Date).ToString())" | Out-File $OutputProcessPath -Append
                "####################################################################################################" | Out-File $OutputProcessPath -Append
            }
            Write-Warning ("Possible AV Modules found in process $($process.ProcessName)")
            $UnexpectedModuleFound++
            foreach ($module in $ProcessModules) {
                if ( $process.MainModule.ModuleName -eq "W3wp.exe" -and $showWarning -eq $false) {
                    Write-Warning "W3wp.exe is not present in the recommended Exclusion list but we found 3rd Party modules on it and could affect Exchange performance or functionality."
                    Write-SimpleLogFile -string "W3wp.exe is not present in the recommended Exclusion list but we found 3rd Party modules on it and could affect Exchange performance or functionality." -name $LogFile
                    $showWarning = $true
                }
                $OutString = ("[FAIL] - PROCESS: $($process.ProcessName) PID($($process.Id)) MODULE: $($module.ModuleName) COMPANY: $($module.Company)`n`t $($module.FileName)")
                Write-SimpleLogFile -string $OutString -Name $LogFile -OutHost
                $OutString | Out-File $OutputProcessPath -Append
            }
        }
    }
}

if ($UnexpectedModuleFound -gt 0) {