Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 8511 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cleanup Actions > Deny access and move to....

AV_Guy

From the Enterprise Console, I've configured a policy with the following cleanup actions:

  • Virus/Spyware: Deny access and move to \\server\quarantine
  • Suspicious Files: Deny access and move to \\server\quarantine

Automatic cleanup is unchecked.

This configuration is working. Files are successfully being moved to the specificed path. From there I can then scan the files on the server hosting this share and clean a majority of the,..

How do I restore the files to their original path once cleaned??? 

:49348


This thread was automatically locked due to age.
  • 0

    HI,

    What is the reason behind moving them to a network location?

    The only way to know where they came from would be to use SAV.txt on the endpoint.

    Regards,

    Jak

    :49350
  • 0

    We recently implemented Sophos Anti-Virus for NetApp Storage Systems. In the startup guide the instructions are as follows:

    Ensure that the Automatically clean up items that contain a virus/spyware check box is cleared. Click Deny access and move to. Using the Browse button, specify the path of the folder to which infected files should be moved. 

    The folder must be on the anti-virus server, and should preferably be accessible to anti-virus administrators only.


    We assumed that moving the files was a temporary action for cleaning / quarantine. Now we have 3,000+ files on our AV and no clue how to get them back to their original location.....

    :49352
  • 0
    After working with support it seems there is no good way to restore these items to their original location. My team is now working to script the process.

    Not to self - don't use the "move to" feature....
    :49384
  • 0

    Hi,

    If the computer is SEC managed, then you could use the SEC database as the source of the paths to help move them back, otherwise you will have to parse SAV.txt to get the info.

    Regards,

    Jak

    :49388