cancel
Showing results for 
Search instead for 
Did you mean: 

No Evidence in Evidence Locker

Jump to solution
Hello, I'm setting up a new instance of DLP Protect 11.2 connecting to EPO 5.9.1. My DLP rules are firing, I'm getting alerts, and I can see them in Incident Manager. My issue is; When I got and select some evidence I get "Access to evidence file denied." and when I look in my Evidence Storage share I see no files/directories. The share is on the same server as EPO and "Test Credential" works. I've also added the server and SYSTEM to the share and NTFS rights. Not sure what else I am missing and my Google Fu is failing. Thanks, -eddy
1 Solution

Accepted Solutions
McAfee Employee JaganA
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: No Evidence in Evidence Locker

Jump to solution
@easimons Check the DLP agent connectivity status within DLP endpoint console, it must be online (connected to corporate network) in order to replicate the evidence files. The DLP agent queries the ePO server every 30 seconds to decide its connectivity. FQDN of the ePO server should resolve successfully.
JaganA
McAfee Employee

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
3 Replies
McAfee Employee JaganA
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: No Evidence in Evidence Locker

Jump to solution
@easimons Check the DLP agent connectivity status within DLP endpoint console, it must be online (connected to corporate network) in order to replicate the evidence files. The DLP agent queries the ePO server every 30 seconds to decide its connectivity. FQDN of the ePO server should resolve successfully.
JaganA
McAfee Employee

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: No Evidence in Evidence Locker

Jump to solution

Hi,

Thanks for the response.  Wasn't the issue but it pointed me in the correct direction.  (I missed a log and some settings.)  This version new to me and the documentation was a little confusing.

Thanks again!

-eddy

Highlighted

Re: No Evidence in Evidence Locker

Jump to solution

Hi

What was the issue and how did you resolve it?

Thanks

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community