Access is denied., Error Code : 5

[dfos23]

We keep receiving this message in DLP Operations from workstations for Evidence Replication and I'm not sure what's causing this.  All of the Windows Client Config policies has the correct password for evidence copy.  Any ideas?

DLP Endpoint version:  11.2

ePO Agent Version:  5.6.1

dfos23

[eg123]

there has a KB article on how to troubleshoot permission issue  using  psexec tool:

https://kc.mcafee.com/corporate/index?page=content&id=KB81399

hope this helps.

[dinesh773]

it may happen when you have configured ePO server as connectivity test in windows client configuration.

Kindly review the client configuration policy under connectivity test & share the share details. to help me out.

[dfos23]

I have "copy evidence using the following credentials", checked in Windows Client config. That credential has RW permissions on the evidence share.

[Fademidun]

Have you check the permission for end user, everyone - they need read/write permission?
You must configure write permission for the user account that writes to the evidence folder, such as the local system account on the server. In order to view evidence from McAfee ePO, you must allow read access for the local system account of the McAfee ePO server.