Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Unable to release quarantined file to network drive

Updated: 21 May 2010 | 6 comments
JacekKal's picture
0 0 Votes
Login to vote

I'm evaluating Symantec Endpoint Protection 11.0.4202.75.
User started manual scan on a network drive. One of the files were quarantined, but I added exception (it is important file) to skip this file.

But SEP is not able to release this file from quarantine. I have found in file server (server, where network drive is mapped) logs, that SEP is trying to release this file as a guest, not a user currently logged on.
Guest has no access to this share, so I'm not able to release file.

How can I restore this file?

Workstation is XP Pro SP3 and is a domain member.
Server (file server) is a domain controller and server with installed SEPM is also a domain member.

Comments

Rafeeq's picture
16
Sep
2009
1 Vote +1
Login to vote

Hi

not sure if you have tried this step

log in to the box which has quarentined the file

open the SEP interface

Click on view quarentine

you will find the file here

click on Restore...

This will restore the file to its original place. Marke sure to create Centralized Exception.

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

Prashant Bharadwaj's picture
16
Sep
2009
0 Votes 0
Login to vote

When you restore from SEP, it

When you restore from SEP, it will ask for an alternate location to restore if the restore fails. restore to a different location, then manually copy the file and paste it back to the original location with a valid credentical. If this is working, probably you would to give full access to everyone and then restore the file. Once done, withdraw the full access permission for everyone

Prashant Bharadwaj, CEH, MCTS Windows Server 2008 Active Directory, Configuration, SCS Symantec Endpoint Protection 11.0

Rafeeq's picture
16
Sep
2009
0 Votes 0
Login to vote

Hi

BharRie is correct,

The Quarantine folder will not have any rights, click on properties and you wil find no rights, assigned.

once its recoved assign appropriate permissions. restore it to original location.

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

JacekKal's picture
16
Sep
2009
0 Votes 0
Login to vote

BharRie, but it doesn't ask

BharRie,
but it doesn't ask for alternate location. Maybe I will write what I'm exactly doing (sorry for mistranslations, but I will translate messages from Polish):
- open SEP on workstation
- click show quarantine
- right click on quarantined entry and select restore
- select yes with question: do you really want to restore selected files?
- select no (or yes - doesn't matter) with question: do you want to create exclusion for restored (...) files?
and next is an error message:
Try to release quarantined file: failed (with OK button only)
and next message after clicking ok: error ocured during restoring an object (also with OK button only).

And details for an object in quarantine (I know it is polish language, but if you open your threat, you can assign polish-english words - if not, tell me, I will try to translate).

sep_quarantine1.png

JacekKal's picture
20
Sep
2009
0 Votes 0
Login to vote

Hi, Do you have any idea,

Hi,

Do you have any idea, how to restore this file?

JacekKal's picture
29
Sep
2009
0 Votes 0
Login to vote

I have tested 11.0.5002.333

I have tested 11.0.5002.333 (english) version and there is the same problem:
quarantine1.jpg

quarantine2.jpg Yes

quarantine3.jpg No

quarantine4.jpg

quarantine5.jpg

If I create any file in original location with original filename, it will ask me for a different location:
quarantine6.jpg

If I will answer No, I can chose alternate location. Specifing eg. my desktop, I got exactly the same error:
quarantine4.jpg

quarantine5.jpg

And once more english details of quarantined file:
quarantine7.jpg

Guys, any idea? Please help me.