3 Replies Latest reply on Mar 16, 2017 8:25 AM by joseph.butler

    How to stop scan64/scan32 from getting audit failures

    kenostaszewski

      Hi,

       

      We have a mix of Windows OS machines.  Earliest is Win Server 2008.

       

      We are running Virus Scan Enterprise 8.8 Patch 4, with an EPO at 4.6.9

       

      All of the machines are receiving event code 4656 Audit Failures for gaining WriteAttributes.

       

      On average, we are seeing 180,000 of these per machine daily.

       

      Does anyone know how to stop Virus Scan Enterprise from requesting WriteAttributes before they are needed to quarantine an infected file?

       

      Is there some setting in the EPO server we can trigger?

       

      I am attaching a file showing an example of of of these events.

       

      thx.