We recently updated our DLP client to DLP9.1 patch 1 (220.127.116.11 running with extension 18.104.22.168. We have seven ePO servers in the environment all running the EXACT same setup and policy.
For some reason, machines homed on only ONE of the ePO servers are experiencing an issue in which they cannot save Excel spreadsheets to a network share.
We've taken the following troubleshooting steps:
1) First, DLP was uninstalled, the machine in question rebooted, and we were able to save directly to the network share.
2) DLP was reinstalled/rebooted, and we could no longer save directly to the share. (This is not a specific share; it's specifically Excel spreadsheets and any network share.)
3) We can save the Excel spreadsheet locally and copy it over to any share fine.
4) We moved the machine to another ePO server, uninstalled/rebooted, reinstalled/rebooted, and we could save directly to the share fine. As soon as the machine was placed back on the ePO server in question and policy updated, we could no longer save.
5) We imported the global agent configuration from one of our functioning servers to the trouble ePO server, and we still could not share even after policy refresh/reboot.
6) We disabled all the computer assignment groups on one machine, and rebooted, and could not save.
7) We disabled the only "module" of DLP we are utilizing (DCM): Removable Storage Protection. We rebooted, and COULD save directly to the network share. Turning it back on and rebooting gave us the same problem.
Our policies on the other ePO servers are identical and no machines on them are experiencing this issue. It is not every machine on this specific server experiencing the issue.
Below is a piece of the DLP debug logs we pulled on a machine experiencing the problem. It is replicated every time we attempt to save the a spreadsheet to a network share.
Imagine the "FILESHARE SERVER NAME" is a machine name.
14:23:30:291 [ODEBUG] (5652-5656) [DNS Service][DNSResolvingService::translateServer2KeyServerName] resolve alias *FILESHARE SERVER NAME* as server *FILE SHARE SERVER NAME*
14:23:30:291 [OERROR] (5652-5656) [File Handler][FileFilterHandler:nClose] We don't have open info on this file (1251223)
I tried mapping the share directly to an IP address and received the same error in the debug log, except obviously the server name was replaced with an IP address.
I currently have an SR open with McAfee at Tier 3, but we have found no joy yet on a way forward with the issue.
Has anyone seen anything similar?
In Agent Configuration, under Advanced Configuration, do you have anything enabled? Also, under Miscellaneous, is Device Blocking handler checked? If both checked (enabled), disable anything under Advanced Configuration.
Noticed you said the DLP extension version is 22.214.171.124. If you are running HDLP 9.1 with patch 1, the extension version should be 126.96.36.199, isn't it? You may have to upgrade the extension.
Thanks for this post. We have had this issue for the last month and been all round the houses with Microsoft/AD/NAS etc until I saw this !
We are using DLP 188.8.131.522 with ePO 4.5 Patch 4 plus hotfix.
We have found it ONLY kicks in when the subfolders or file name of the DFS share is less then 8 characters or does not have a space in it. As soon you you rename to over 8 characters or put a space in you are able to save the file. Very very odd.
Only affecting Non Admin account (pretty much everyone)
Only affecting excel . We have found with excel 2010 you can save xlsx files but that is the only format.
Like above we use the Removeable storage blocking rule only.
About to open a case with McAfee :-(
Please open a service request with the technical support team. We will help you to investigate the issue and provide a fix.
I have the same issue on my network, all computers have installed McAfee ePO 4.6 and DLP 184.108.40.206.
However, my problem is a little bit worst, it happens with Excel, Powerpoint and Word and always on file save process.
It is not a problem that happens all the time that a file need to be saved, but it is making all my users crazy.
I have uninstalled DLP on a test computer and this issue stopped happening, so I installed DLP again and disable on DLP Miscellaneous the option "Device Blocking (*)". After that I had no more problem to save MS Office files, but I had problem to block personal storage.
It problems happen when the file is saved on network drive, it does not happen if the file is saved on computer local drive.