DLP Scanning BitLocker Placeholder File - Uses All C: Drive space
I have come across an issue when using DLP (client version 11.1.0.07015) with Microsoft BitLocker on Windows 7 64bit.
As I understand, when I write a file to a removable drive, DLP will create a snapshot (.SNP) file in "C:\Program Files\Symantec\Endpoint Agent\temp" to scan it.
The problem is that when I connect and encrypt my 300GB external USB hard disk drive, BitLocker will create a "placeholder" file to reserve free disk space on the disk (I believe it does this to make encryption more efficient on drives formatted with NTFS or exFAT). When this file is written, DLP attempts to scan the file, and attempts to copy the 294GB placeholder file to the above location.
The problem is that my C: drive is only 120GB in size, so the creation of the .SNP file uses up all of my available hard disk space, and stops encryption from completing.
I have also noticed that the DLP agent also behaves the same if I copy a very large single file from a network share to a removable drive.
So it seems that DLP cannot scan a file being copied to a removable drive, if the file size is larger than the amount of free disk space on the clients C: drive.
If anyone knows of any configuration that could prevent this behaviour I would be very interested to know.