I have been asked a question by a customer that I am not sure on the answer!
They have some protection rules in place to stop people copying certain files to USB. They have this rule set to Block and Monitor.
They have noticed that the local Quarantine folder is filling up with files on the clients.
Question is do these files stay permanently or do they get removed. Is there a way to stop files being quarantined and just blocked?
if you use the standard settings, the quarantained files are deleted after 30 day. If you want to change this behaviour you have to edit the global agent configuration (tab miscellaneous).
The reason why the files are quarantained is:
1) User copys file to USB drive
2) DLP Agent deletes files
3) User thinks files are stored on the USB drive
4) User deletes files
If the files are deleted from the USB drive without beeing moved to Quarantine, the files are lost.