cancel
Showing results for 
Search instead for 
Did you mean: 

No Evidence in Evidence Locker

Jump to solution
Hello, I'm setting up a new instance of DLP Protect 11.2 connecting to EPO 5.9.1. My DLP rules are firing, I'm getting alerts, and I can see them in Incident Manager. My issue is; When I got and select some evidence I get "Access to evidence file denied." and when I look in my Evidence Storage share I see no files/directories. The share is on the same server as EPO and "Test Credential" works. I've also added the server and SYSTEM to the share and NTFS rights. Not sure what else I am missing and my Google Fu is failing. Thanks, -eddy
1 Solution

Accepted Solutions
Highlighted
McAfee Employee JaganA
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: No Evidence in Evidence Locker

Jump to solution
@easimons Check the DLP agent connectivity status within DLP endpoint console, it must be online (connected to corporate network) in order to replicate the evidence files. The DLP agent queries the ePO server every 30 seconds to decide its connectivity. FQDN of the ePO server should resolve successfully.
JaganA
McAfee Employee

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
2 Replies
Highlighted
McAfee Employee JaganA
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: No Evidence in Evidence Locker

Jump to solution
@easimons Check the DLP agent connectivity status within DLP endpoint console, it must be online (connected to corporate network) in order to replicate the evidence files. The DLP agent queries the ePO server every 30 seconds to decide its connectivity. FQDN of the ePO server should resolve successfully.
JaganA
McAfee Employee

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: No Evidence in Evidence Locker

Jump to solution

Hi,

Thanks for the response.  Wasn't the issue but it pointed me in the correct direction.  (I missed a log and some settings.)  This version new to me and the documentation was a little confusing.

Thanks again!

-eddy

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support

    • Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center