Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 1 subscriber
  • Views 17379 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos scanning network locations

BUKtrj

Hello all,

A bit of info before i go on, we just installed Enterprise Console 5.2 on a clean 2012 R2 server, deployed to a few test machines as this is replacing an old symantec solution.

The problem is that we use Quest for keeping an eye on folder activity (opening, deleting ect) but since 2 of our laptops had sophos installed Quest reports that the user accounts tied to the laptops are continually scanning our network location where home drives are located, Quest doesn't report the same activity for my machine, the only differences is that the other 2 users have offline folders enabled for their home drives and i'm on Win7 to their Win8.1, we have added the CSC folder to the exclusions in the hope this was the cause.

Any advice appreciated.

:45889


This thread was automatically locked due to age.
Parents
  • 0

    Hello BUKtrj,

    I'm still trying to figure out what exactly constitutes the issue. On-Access, as its name implies, scans (only) those files that are accessed. If I understand correctly you see accesses on the fileserver when Sophos is installed on the endpoint which you otherwise don't see.

    You've already tried excluding the cache (CSC) folder which didn't make a difference. As you are in a testing phase I'd suggest that you turn off on-access scanning - if there is a significant change then it's indeed on-access. Do you have any details from Quest what this extra activity actually is? Sysinternal's Process Monitor can show the file system activity on and might help to determine what savservice is doing for the offline files.

    Christian 

    :45933
Reply
  • 0

    Hello BUKtrj,

    I'm still trying to figure out what exactly constitutes the issue. On-Access, as its name implies, scans (only) those files that are accessed. If I understand correctly you see accesses on the fileserver when Sophos is installed on the endpoint which you otherwise don't see.

    You've already tried excluding the cache (CSC) folder which didn't make a difference. As you are in a testing phase I'd suggest that you turn off on-access scanning - if there is a significant change then it's indeed on-access. Do you have any details from Quest what this extra activity actually is? Sysinternal's Process Monitor can show the file system activity on and might help to determine what savservice is doing for the offline files.

    Christian 

    :45933
Children
No Data