Server logging "Access to computer "computername" denied because it may be unsafe

Hi,

Can you share with us the sample snapshot of the alert that you received? also, what was the relationship of this device to the server? was the client machine accessing some application/files on this server? 

Hi,

Can you share with us the sample snapshot of the alert that you received? also, what was the relationship of this device to the server? was the client machine accessing some application/files on this server? 

Morning GlennSen,

 See image. All the blacked out names all refer to a single computername. Both server and computer are in good health. The computer is access is heavily used financial application over https.

Thanks!

HI Stuart Hamilton1

When a device triggers red health or missing Security heartbeat all other devices on the same subnet are informed the device is unsafe. Could you please check the steps mentioned here and see if it helps. 

Morning Shweta,

I have this turned on. But as stated above, but server and client are in good health. This is why I can't figure out why it is blocking.

Thanks for the assist.

By any chance do you have Sophos XG in your Environment as well? If so? Can you validate if the " Allow devices to reject connections from other devices with red health" option is currently enabled on your XG settings? You may refer to this article for more details. and if all of the above statements are true, then we will be going to proceed with checking with the endpoint client level as to why it got rejected. 

Morning GlennSen,

Yes, this is enabled on my XG. But these two devices are on the same subnet inside the XG, and it is the server that is denying the connection and not the XG.

On the client/server level, both show in good health and the events show no reason for the denial except "may be unsafe".

Thanks again.