Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 4635 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Warning Scan all Domain Controller

GSolz78

Hi I have Sophos Endpoint Enterprise Console 3.1 and for all my domani controller I have the same Warning :

The access driver failed to determine the new file name \device\Harddiskvolume1\Windows\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory_24dba27-31d0-4f03-aea7b24638e738da because is renamed, i have set a check with this Exclusion :

%SystemRoot%\ntfrs\jet\log\*.log
%SystemRoot%\ntfrs\jet\ntfrs.jdb
%SystemRoot%\ntfrs\jet\sys\edb.chk
%windir%\NTDS\dsadata.bak
%windir%\ntds\edb.chk
%windir%\ntds\edb.log
%windir%\NTDS\edbtmp.log
%windir%\ntds\Ntds.dit
%windir%\ntds\Ntds.pat
%windir%\ntds\res1.log
%windir%\ntds\res2.log
%windir%\ntds\Temp.edb
%Winnt%\Cluster
*.ldf
*.mdf
*.ndf
*.trn
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\Backup
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\Data
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\Log
C:\Programmi\ORL\VNC\WinVNC.exe
C:\windows\sysvol\
C:\WINDOWS\SYSVOL\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory
C:\windows\sysvol\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\*
C:\windows\sysvol\staging areas\*
C:\windows\sysvol\staging\domain\*
C:\windows\sysvol\sysvol\*
D:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\Backup
D:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\Data
D:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\Log
D:\WINDOWS\NTDS\dsadata.bak
D:\WINDOWS\NTDS\edb.chk
D:\WINDOWS\NTDS\edb.log
D:\WINDOWS\NTDS\edbtmp.log
D:\WINDOWS\NTDS\Ntds.dit
D:\WINDOWS\NTDS\Ntds.pat
D:\WINDOWS\ntds\res1.log
D:\WINDOWS\ntds\res2.log
D:\WINDOWS\NTDS\Temp.edb
D:\windows\sysvol\
D:\windows\sysvol\domain\DO_NOT_REMOVE_NtFrs_PreInstall_Directory\*
D:\windows\sysvol\staging areas\*
D:\windows\sysvol\staging\domain\*
D:\windows\sysvol\sysvol\*
pagefile.sys
Q:\

I Have find in the server directory but i don't have no folder under DO_NOT_REMOVE_NtFrs_PreInstall_Directory.

Where is the problem? or where is the correct exclusion?

Thank you for the attention

Best Regards

Giulio

:3138


This thread was automatically locked due to age.
  • 0

    Hello Giulio and welcome to the forum

    First of all, please quote the exact message together with the error code if possible. And also tell us the SAV (I assume 7.6) and OS version. How frequent does this message occur - or was it a one-time event?

    Your exlusions probably don't work as expected (I know, these are tricky):

    % is not a special character but valid in a filename. Therefore %SystemRoot% will be treated as a folder name and not expanded to C:\Windows as you might expect . You have probably noted that you can specify the wildcard characters ? and * only in certain places but you might have missed that they can be used only in a filename or extension. Thus D:\windows\sysvol\staging areas\* means: exclude in the named folder only  all files without extension, as the * stands for a filename. And the or is exclusive, that is *.* is not valid.

    Christian

    :3143
  • 0

    Thank you for the replay.

    My Sophos Client is 7.6.19 the domain controller are Windows 2003 and Windows 2003 R2, the error code message is e03d0011 and the descprion is in Italian.

    Then my exclusion is not correct....

    %windir%\ntds\Temp.edb --> C:\Windows\ntds\Temp.edb

     and for exclude all folder i replace :

    C:\windows\sysvol\staging areas\* with C:\windows\sysvol\staging areas .

    Is corect??

    Thanks

    Giulio

    :3148
  • 0

    Don't mention it!

    Well, e03dxxxx are scanning errors (obviously :smileyhappy:) and while some are self-explanatory the majority is not. I'd ask support for an explanation. You did not say whether this has been a one-time event or if it's recurring. If the former I guess you can simply ignore it.

    and for exclude all folder I replace:
    C:\windows\sysvol\staging areas\* with C:\windows\sysvol\staging areas

    Close but no cigar :smileyhappy:. This would mean exclude the file named staging areas (without extension) in the C:\windows\sysvol\ folder. To exclude a folder (and anything in it) you have to use a trailing backslash: C:\windows\sysvol\staging areas\. The client GUI offers you the three types Drive, Folder and File and for Folder it appends the backslash if it's not there.  SEC assumes you know what you do :smileywink:

    Christian

    :3155
Unfiltered HTML