Showing results for 
Search instead for 
Did you mean: 
Level 7

Evidence is not available


        I installed mcafee epo 4.6 and mcafee dlp 9.3, configured policy like email, screen capture, webpost ,etc.... In DLP incident manager all policy logs are showing but when i tried to open that incident it is showing evidence not aviable but  I can view the evidence for one client machines which is installed my epo and dlp server. I attached screen shot for evidence view page error.jpg is client pc and error1.jpg is server machines

0 Kudos
1 Reply
Level 7

Re: Evidence is not available

Hi, Firdhous

I have the same issue. In my case I have made upgrade from 9.2 DLP Endpoint to 9.3 on 4.6.6 ePO.

I have made the same as writen in KC


After you upgrade Data Loss Prevention Endpoint (DLPE) 9.3 from a previous version (9.2 or earlier), you see the following error message if you try to view evidence attached to an incident:

Evidence File is Not Available


The share permissions are not configured correctly.

Because DLPE 9.3 does not utilize the WCF service, the user accessing the evidence share is the user assigned to the ePO Application Service. If you have configured the WCF service to run as a service account and the share permissions to only allow full access to the service account, the DLP extensions cannot view the files in the evidence share.


Add share permissions for the ePO server computer object with full access to the evidence share.

0 Kudos