cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
User16096767
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 1 of 7

A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

Hi Team,

Where is the documentation that shows the event is by designed for "A sharing violation error" is logged in the local log file after scanning the C:\Windows folder. EventID=34924.

I explained the customer but it looks like I need to show documentation. 

1 Solution

Accepted Solutions
pv
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

Hi @User16096767 

You can disable informational events from ENS common policy.

Follow the below steps:

Go to Policy catalog -> Endpoint Security Common policy -> Event logging -> On Demand Scan ->

Select "Critical and alerts".

Apply the policy to the system.

Hope this helps!

Thanks 

GPV

View solution in original post

6 Replies
pv
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

Hi @User16096767 

Thank you for your post.

Issue: A sharing violation error is logged in the local log file after scanning the C:\Windows folder. The sharing violation is expected because of the files being open exclusively (no shared read) in Windows processes.

Resolution: This behavior is as designed. The sharing violation error severity is set to Informational. This fact means that by default, the error isn’t sent to ePolicy Orchestrator. Also, the error doesn’t display in the Windows Event Log by default.

Refer KB: https://kc.mcafee.com/corporate/index?page=content&id=KB82450

Thanks

GPV

User16096767
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 7

Re: A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

For some reason, I couldn't find it in that KB. where is it listed under?

User16096767
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 7

Re: A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

How do we disable that event from generating on local machines? Customer want to cut the noise.

pv
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 7

Re: A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

Hi @User16096767 

 

Expand the Open issue section in the article KB82450 and search for "982238" to view the details.

 

Please do follow the below steps to disable the event ID "34924".

 

  1. Click MenuConfigurationServer Settings.
  2. Click Event Filtering under the Setting Categories column, and click Edit.
  3. Deselect the Event IDs, as needed.

 

Hope this helps!

 

Thanks

GPV

User16096767
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 6 of 7

Re: A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

Its already disable by default from ePO. The issue is that event is generated on the local machine as informational and the customer wants us to disable it. I didn't see the option from eventvwr to disable it. 

 

unselecting  from ePO, I think all it does is preventing agent sending the event to ePO or SIEM, not necessarily disabling event being generated on the local machines.

pv
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: A sharing violation error is logged in the local log file after scanning the C:\Windows folder

Jump to solution

Hi @User16096767 

You can disable informational events from ENS common policy.

Follow the below steps:

Go to Policy catalog -> Endpoint Security Common policy -> Event logging -> On Demand Scan ->

Select "Critical and alerts".

Apply the policy to the system.

Hope this helps!

Thanks 

GPV

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community