1 Reply Latest reply on Aug 21, 2013 11:34 PM by professor_is

    Evidence is not available

      Hi,

       

              I installed mcafee epo 4.6 and mcafee dlp 9.3, configured policy like email, screen capture, webpost ,etc.... In DLP incident manager all policy logs are showing but when i tried to open that incident it is showing evidence not aviable but  I can view the evidence for one client machines which is installed my epo and dlp server. I attached screen shot for evidence view page error.jpg is client pc and error1.jpg is server machines

        • 1. Re: Evidence is not available
          professor_is

          Hi, Firdhous

          I have the same issue. In my case I have made upgrade from 9.2 DLP Endpoint to 9.3 on 4.6.6 ePO.

          I have made the same as writen in KC https://kc.mcafee.com/corporate/index?page=content&id=KB78553&actp=LIST

           

          Problem

          After you upgrade Data Loss Prevention Endpoint (DLPE) 9.3 from a previous version (9.2 or earlier), you see the following error message if you try to view evidence attached to an incident:

          Evidence File is Not Available

           

           

          Cause

          The share permissions are not configured correctly.

           

          Because DLPE 9.3 does not utilize the WCF service, the user accessing the evidence share is the user assigned to the ePO Application Service. If you have configured the WCF service to run as a service account and the share permissions to only allow full access to the service account, the DLP extensions cannot view the files in the evidence share.

           

           

          Solution

          Add share permissions for the ePO server computer object with full access to the evidence share.