I am using DLP 184.108.40.2061 and have had problems getting the evidence share folder to work. the sytem will not copy files to the shared folder and I can't find any error messages to find out why To get around this problem, I changed the home directory for the Quarentine to my evidence share which works fine, so now everytime a file is blocked, the file gets copied to my evidence folder.
The problem that I have is that when a user gets the notification that his file has been blocked, the popup message has a link to the quarentine folder. How can I get rid of this link so that the user cannot access the file that was quarentined?
You could change your protection rule and set it not to monitor. DLP will then still block the file but it won't prompt the user when it blocks something. Otherwise you can go into your DLP global agent policy and on the Notification Service tab uncheck Show notifications and the user will not be notified when ANY protection rule is violated.on 5/17/10 3:30:53 PM CDT
I believe that you have misunderstood the usage of Quarantine Folder and Evidence Share.
Evidence folder must be located on a File Server or SAN storage. Ensure that you have setup the permissions correctly. This is where all evidence files are stored by default.
Quarantine folder must be loacted on the user's local hard drive. This folder is used to ensure that files opened directly from Removable Storage Media are not lost when DLP deletes them.
For all other instances / rules evidence files are sent to Evidence Share and not Quarantine Folder.
Turning off "Monitor" reaction does not stop the user from receiving notifications, instead it stops events from being recorded by HDLP.
Turn off "Notify User" reaction in order to ensure that the user does not receive notification when the corresponding rule is triggered.
Do not turn off "Show Notifications" or "Agent Popup Service" under Agent Configuration unless you want to disable notifications / popups for all rules.