`<filter root="/etc/secureaem"> <exclude pattern="/etc/secureaem/jcr:content/globalConfig"/> </filter>` It will always overwrite any nodes that are added in the /etc/secureaem path.