SEPM upper cases 'n' in exclusions
I am trying to add an exclusion for a folder on our network attached storage. Unfortunately the DNS name is nas1 so the path is \\nas1\folder\folder2.
However when manually adding a centralized exclusion the 'n' gets upper cased so the path reads \\Nas1\folder1\folder2 and thus (I think!) the exclusion is not honoured.
I have tried adding the exclusion via the logs but the n is still upper cased. Note that the logs report a lower case n
Removing the leading slash results in the n staying lower case but effectively the path is now incorrect so the exclusion does not work.
I have tried to use other letters i.e. the letter 'a' for example resulting in the path \\aas1\folder1\folder2 these alternative letters are NOT upper cased it only affects the letter 'n'.
I have tried a wildcard (*) in place of the 'n' which does not work.
Server 11.0.5002.333
Client 11.0.5002.333
I upgraded specifically to get around this issue...from the RU5 release notes.
Centralized Exceptions does not function in exceptional situations
Fix ID: 1179354
Symptom: When creating a centralized exception for a directory that starts with a lower case n in the directory name, the exclusion does not work properly. This behavior also effects file exclusions and Tamper Protection exclusions. Garbage characters replace the "\n" and placing an infected file in the folder causes an alert to trigger even though that folder is supposed to be excluded.
Solution: Exceptions handle "\n" so that garbage characters are not created and exceptions work as expected.
Can anyone point me in the right direction?
Thanks,
Jim
Comments
Hi, have you adding this
Hi,
have you adding this folder as a network drive. Then open SEP client, go to change settings for AV/AS-> File System Autoprotect-> Uncheck "Scan files on network drives".
You can configure a similar policy from SEPM as well.
Aniket
Hi Aniket, Thanks for your
Hi Aniket,
Thanks for your reply. Unchecking "Scan files on network drives" after mapping a folder to a drive doesn't work, however this is irrespective as users often use the UNC path not bothering to actually map a drive.
For reference if I map the folder to a drive then exclude it via centralized exclusions it works correctly - which is exactly what I would expect there seems to be no problem with specifying drive letters the problem seems to only be concerning UNC paths.
Since different users map it to different drive letters as it's not something that is mandatory or required for everybody it is not a workable solution.
Should a centralized exception starting \\nxxx work???
If a UNC path that begins with lower case 'n' and gets altered in this way, yet no other lower case letters do is this not a bug?
Cheers,
Jim
Correct. Looks like a
Correct. Looks like a bug.....
Though the upper case should not be related to the exclusion.
If it's programmatic bug, you can try the escape sequence for it like
\^\nas\path
or
\\^nas\path
It still might get to be in capital case but might work.
De facto when AV does something, it starts jumping up and down, waving its arms, and shouting "Hey! I found a virus! Look at me! I'm soooo goooood!"
Hi Sandeep, Thanks for the
Hi Sandeep,
Thanks for the suggestions, I've tried both I'm afraid with no luck. For your info the first method \^\nas\path does still upper case the 'n', but the second \\^nas\path does not.
If this is a bug then will it get passed over to be fixed just from this forum, or do I need to log it somewhere any info is greatly appreciated.
I would be grateful if anyone has any further suggestions I'm happy to do some testing if it helps (although I am in a live environment!).
Thanks,
Jim
It should be done here.
It should be done here. Aniket, If you could please pass the information on to the backline for an etrack and ACK it if you feel like testing it, I confirm Jim's findings.... Thanks........
Jim, Alternatively.....can also report it to Eric http://www.symantec.com/connect/articles/community... on behalf of your organization(for the records) or as an individual...
De facto when AV does something, it starts jumping up and down, waving its arms, and shouting "Hey! I found a virus! Look at me! I'm soooo goooood!"
Would you like to reply?
Login or Register to post your comment.