1. Why software evidence appears outside the Include paths

The Snow Inventory Agent for Windows generates inventory output from multiple data sources, not limited to file-system scans. The collected information may come from: 

• File-system scanning (defined by Include and Exclude parameters) 
• Windows Registry (used to identify installed software and evidence) 
• WMI and CIM queries (used to gather system and licensing data)

As a result, software evidence entries can include references to directories outside the configured file-scan paths. Registry and WMI data may refer to installations located elsewhere, and therefore this outcome is expected according to the agent’s documented scanning process. For reference: The scanning process | Snow Inventory Agent for Windows.

PowerShell-based scan scripts can also contribute to this behavior. For example, the scan-msinfo script collects information through WMI and CIM queries and includes this information in the inventory output, unaffected by the Include file-path settings.

2. Impact of an empty Include configuration with only Exclude rules

When the configuration contains no <Include> rules, the agent treats this as a directive to perform a wide file-system scan. This configuration can lead to:

• Increased scan time due to broader folder coverage
• Larger inventory files with additional, less relevant data
• Additional evidence from non-installation areas such as caches or temporary folders

Although such configurations are permitted, they demand carefully defined Exclude rules to manage scan performance and data volume effectively.

3. Recommended configuration approach for multiple drives

For environments with multiple drives, targeted Include paths typically provide the optimal balance between accuracy and performance. 

It is recommended to define Include rules for standard software installation directories on each drive rather than scanning entire volumes. 

If a complete scan across all drives is required, limit data volume and duration by refining scan parameters to collect only relevant file types and excluding large or irrelevant directories.

Understanding that the inventory scan uses several data sources helps explain evidence entries outside defined Include paths. Properly adjusted Include and Exclude configurations improve scan completeness and efficiency.