Endpoint Protection

 View Only
  • 1.  Unable to release quarantined file to network drive

    Posted Sep 16, 2009 09:36 AM
    I'm evaluating Symantec Endpoint Protection 11.0.4202.75. User started manual scan on a network drive. One of the files were quarantined, but I added exception (it is important file) to skip this file. But SEP is not able to release this file from quarantine. I have found in file server (server, where network drive is mapped) logs, that SEP is trying to release this file as a guest, not a user currently logged on. Guest has no access to this share, so I'm not able to release file. How can I restore this file? Workstation is XP Pro SP3 and is a domain member. Server (file server) is a domain controller and server with installed SEPM is also a domain member.


  • 2.  RE: Unable to release quarantined file to network drive

    Posted Sep 16, 2009 10:12 AM
    not sure if you have tried this step

    log in to the box which has quarentined the file

    open the SEP interface

    Click on view quarentine

    you will find the file here

    click on Restore...

    This will restore the file to its original place. Marke sure to create Centralized Exception.



  • 3.  RE: Unable to release quarantined file to network drive

    Posted Sep 16, 2009 10:49 AM
    When you restore from SEP, it will ask for an alternate location to restore if the restore fails. restore to a different location, then manually copy the file and paste it back to the original location with a valid credentical. If this is working, probably you would to give full access to everyone and then restore the file. Once done, withdraw the full access permission for everyone


  • 4.  RE: Unable to release quarantined file to network drive

    Posted Sep 16, 2009 10:54 AM
    BharRie is correct,

    The Quarantine folder will not have any rights, click on properties and you wil find no rights, assigned.

    once its recoved assign appropriate permissions. restore it to original location.



  • 5.  RE: Unable to release quarantined file to network drive

    Posted Sep 16, 2009 11:17 AM
    BharRie,
    but it doesn't ask for alternate location. Maybe I will write what I'm exactly doing (sorry for mistranslations, but I will translate messages from Polish):
    - open SEP on workstation
    - click show quarantine
    - right click on quarantined entry and select restore
    - select yes with question: do you really want to restore selected files?
    - select no (or yes - doesn't matter) with question: do you want to create exclusion for restored (...) files?
    and next is an error message:
    Try to release quarantined file: failed (with OK button only)
    and next message after clicking ok: error ocured during restoring an object (also with OK button only).

    And details for an object in quarantine (I know it is polish language, but if you open your threat, you can assign polish-english words - if not, tell me, I will try to translate).

    sep_quarantine1.png


  • 6.  RE: Unable to release quarantined file to network drive

    Posted Sep 21, 2009 03:32 AM
    Hi,

    Do you have any idea, how to restore this file?


  • 7.  RE: Unable to release quarantined file to network drive

    Posted Sep 29, 2009 10:28 AM
    I have tested 11.0.5002.333 (english) version and there is the same problem:
    quarantine1.jpg

    quarantine2.jpg Yes

    quarantine3.jpg No

    quarantine4.jpg

    quarantine5.jpg


    If I create any file in original location with original filename, it will ask me for a different location:
    quarantine6.jpg

    If I will answer No, I can chose alternate location. Specifing eg. my desktop, I got exactly the same error:
    quarantine4.jpg

    quarantine5.jpg


    And once more english details of quarantined file:
    quarantine7.jpg


    Guys, any idea? Please help me.