EMEA Endpoint Management and Mobility Group (EMM)

 View Only
Expand all | Collapse all

Application file deleting issue by sep

Migration User

Migration UserOct 08, 2013 04:39 AM

Migration User

Migration UserOct 08, 2013 06:33 AM

Migration User

Migration UserDec 17, 2013 07:19 AM

  • 1.  Application file deleting issue by sep

    Posted Oct 08, 2013 03:50 AM

    Hi All,

     

    I need some information application related means I have one application it is use only in my organization purpose I am facing issue in that like some time some .exe and .dll file is deleting automatic I already excluded  this application form Symantec exclusion.

     

    My question

     

    1. if I exclude this nothing action will take by Symantec   
    2. how we can find or track why it deleting

     

    any solution please give it to me



  • 2.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 03:56 AM

    My 2 pence worth wink

    1. If the folder for your app is correctly excluded, then SEP should ignore it entirely and won't do anything to it.  I'd suggest checking to ensure the exclusion you've created is correctly assigned and applies to all scan types, security risks and SONAR.
    2. Assuming this is a test system, yuou could try enabling Windows File Auditing to try to discover what/who is deleting the file.  If it was SEP, then there should be log entries on the client recording such an action.


  • 3.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 03:58 AM

    Check this articles

    Handling and preventing SONAR false positive detections

     

    Article:HOWTO55273 | Created: 2011-06-29 | Updated: 2011-12-16 | Article URL http://www.symantec.com/docs/HOWTO55273

     



  • 4.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 04:03 AM

    Thanks for  reply

    how i can enable file auditing and discover for this



  • 5.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 04:10 AM

    Just have a search around the net or ask another admin on your team.  It's fairly common.

    A very quick google gave me back these links:

    http://support.microsoft.com/kb/310399
    http://youtu.be/ZAudZvgZ1aE
    http://sogeeky.blogspot.co.uk/2006/07/how-to-audit-and-track-file-deletions.html

    #EDIT#

    Oh yeah, if you have it, then Symantec CSP can also perform File Integrity Monitoring:

    http://www.symantec.com/critical-system-protection



  • 6.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 04:18 AM

    I thought it is available in Symantec endpoint protecion



  • 7.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 04:23 AM

    Yap, you could use Application and Device Control to montioring File Access events in the folder too.

    #EDIT#

    This will help you setup an appropriate policy:
    http://www.symantec.com/docs/HOWTO56233

    Just switch the settings to log instead and you're away



  • 8.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 04:39 AM

    Hi

    What is the version you are using

    Regards

     



  • 9.  RE: Application file deleting issue by sep

    Broadcom Employee
    Posted Oct 08, 2013 05:35 AM

    Hi,

    Thank you for posting in Symantec community.

    I would be glad to answer your query.

    How to Verify if an Endpoint Client has Automatically Excluded an Application or Directory.

    http://www.symantec.com/docs/TECH105814

    To know more about logs, you should refer this article.

    Creating exceptions from log events in Symantec Endpoint Protection Manager

    http://www.symantec.com/docs/HOWTO54867

    It's a managed client? then can try the following steps.

    Creating Centralized Exception Policies in Symantec Endpoint Protection Manager.

    http://www.symantec.com/docs/TECH104326

    How to Create Exceptions or Exclusions for Tamper Protection Alerts that have already been logged.

    http://www.symantec.com/business/support/index?page=content&id=TECH92553&locale=en_US

     



  • 10.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 06:33 AM

    CLIENT VERSION RU1 MP 1



  • 11.  RE: Application file deleting issue by sep

    Posted Oct 08, 2013 06:38 AM

    Hi

    Can you please upgrade to SEP 12.1.3 and observe

    Regards

     

     

     



  • 12.  RE: Application file deleting issue by sep

    Broadcom Employee
    Posted Oct 08, 2013 07:39 AM

    Upgrade can't be a solution until and unless there is any fix note for this issue.

     



  • 13.  RE: Application file deleting issue by sep

    Posted Dec 17, 2013 07:14 AM
    Thanks for reply currently I am not able to create any new discussion please guide me in this


  • 14.  RE: Application file deleting issue by sep

    Posted Dec 17, 2013 07:16 AM
    I am getting error after save this discussion, i filed all option which is require.


  • 15.  RE: Application file deleting issue by sep

    Posted Dec 17, 2013 07:19 AM

    What error msg do you have received ?