Showing results for 
Search instead for 
Did you mean: 
Level 9
Report Inappropriate Content
Message 1 of 2

Mac OSX Evidence Copy Service showing add ePO server computer account & test credential is failing


I am trying to modify the existing Evidence Copy Service in our DLP Mac OSX Client Configuration policy in the Policy Catalog and I am getting this message below:

1.) You must add the ePO server computer account to the network storage share permission in order for the DLP components to access the files

>>> Do I need to create a local system account within the epo server to get to the evidence share path? The evidence share uses a user "<domain>/some_user_for_evidence" in the properties and it works when I connect to the evidence share path. 

2.) When I do a Test Credential, it is failing. It is the same password that I have set in my Windows Client Configuration policy (and test credential is passing there). I have copied and pasted to make sure there is no error on my end. 

Storage Share (UNC):  Test connection Failed

Copy evidence using the following credentials:

User Name:


Confirm Password:

McAfee ePolicy Orchestrator 

1 Reply
McAfee Employee JaganA
McAfee Employee
Report Inappropriate Content
Message 2 of 2

Re: Mac OSX Evidence Copy Service showing add ePO server computer account & test credential is f

@JKBH1 Thanks for choosing Support Community.

  1. In Windows Explorer, right-click the evidence folder and select Properties.
  2. Click the Security tab, then click Advanced.
    1. On the Permissions tab, click Change Permissions then deselect the Include inheritable permissions from the object's parent option.
      A confirmation message explains the effect this change will have on the folder.
    2. Click Remove.
      The Permissions tab in the Advanced Security Settings window shows all permissions eliminated.
    3. Click Add to select an object type.
    4. In the Enter the object name to select field, type Hostname_of_ePO_server then click OK.
      The Permission Entry dialog box appears.
    5. In the Allow column, select Create Files/Write Data and Create Folders/Append Data. Verify that the Apply onto option says This folder, subfolders and files, then click OK.
      The Advanced Security Settings window now includes ePO_Hostname.
    6. Click Add again to select an object type.
    7. In the Enter the object name to select field, type Administrators, then click OK.
      The Permission Entry dialog box appears.
    8. Set the required permissions.
      Adding administrators is optional, but can be added as a security precaution. Alternately, you can add permissions only for those administrators who deploy policies.
  3. Click OK twice.
    The dialog box closes.

The reason behind the above recommendation is, when attempted to access the evidence files from the ePO console, it uses the system account of ePO server.

Hope, this is useful and clear.

McAfee Employee

Was my reply helpful?
If yes, click "Accept as Solution" in my reply and together we can help other members?
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community