Unable to release quarantined file to network drive

Updated: 21 May 2010 | 6 comments

JacekKal

0 0 Votes

I'm evaluating Symantec Endpoint Protection 11.0.4202.75.
User started manual scan on a network drive. One of the files were quarantined, but I added exception (it is important file) to skip this file.

But SEP is not able to release this file from quarantine. I have found in file server (server, where network drive is mapped) logs, that SEP is trying to release this file as a guest, not a user currently logged on.
Guest has no access to this share, so I'm not able to release file.

How can I restore this file?

Workstation is XP Pro SP3 and is a domain member.
Server (file server) is a domain controller and server with installed SEPM is also a domain member.

discussion Filed Under:

Security, Endpoint Protection (AntiVirus) - 11.x, Endpoint Protection (AntiVirus), Configuring

Comments RSS Feed

Comments

Sep

2009

1 Vote +1

Rafeeq

Hi

not sure if you have tried this step

open the SEP interface

Click on view quarentine

you will find the file here

click on Restore...

This will restore the file to its original place. Marke sure to create Centralized Exception.

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

Sep

2009

0 Votes 0

Prashant Bharadwaj

Symantec Employee

When you restore from SEP, it

When you restore from SEP, it will ask for an alternate location to restore if the restore fails. restore to a different location, then manually copy the file and paste it back to the original location with a valid credentical. If this is working, probably you would to give full access to everyone and then restore the file. Once done, withdraw the full access permission for everyone

Prashant Bharadwaj, CEH, MCTS Windows Server 2008 Active Directory, Configuration, SCS Symantec Endpoint Protection 11.0

Sep

2009

0 Votes 0

Rafeeq

Hi

BharRie is correct,

The Quarantine folder will not have any rights, click on properties and you wil find no rights, assigned.

once its recoved assign appropriate permissions. restore it to original location.

Please don't forget to mark your thread solved with whatever answer helped you : ) Rafeeq

Sep

2009

0 Votes 0

JacekKal

BharRie, but it doesn't ask

BharRie,
but it doesn't ask for alternate location. Maybe I will write what I'm exactly doing (sorry for mistranslations, but I will translate messages from Polish):
- open SEP on workstation
- click show quarantine
- right click on quarantined entry and select restore
- select yes with question: do you really want to restore selected files?
- select no (or yes - doesn't matter) with question: do you want to create exclusion for restored (...) files?
and next is an error message:
Try to release quarantined file: failed (with OK button only)
and next message after clicking ok: error ocured during restoring an object (also with OK button only).

And details for an object in quarantine (I know it is polish language, but if you open your threat, you can assign polish-english words - if not, tell me, I will try to translate).