Can only clean up quarantine items if user has local admin rights

Hello Daniel,

Sophos does not elevate a user's rights. Thus a user who doesn't have write access to an infected file can't request cleanup/delete even as member of the SophosAdministrator group.

Christian

Hello Christian

But the infected file is located in the Appdata folder of the user.

The user has write access to the folder where the file is located.

Is that normal the behaviour also in this case?

Can only a user with local admin rights clean up infected files?

Kind regards,

Daniel

Hello Daniel,

thin ice, thin ice. Assuming On-Access detection here. The state in QM and the console (and whether an item ends up in QM) depends on a number of things, first and foremost the settings (automatic cleanup and alternate action). Cleanup is also not a simple scrub this file, it might involve an additional scan of parts of the filesystem and the registry and affect other items as well. I have not investigated whether it makes a difference if the on-access policy just blocks the file (and subsequently it's under QM's control) or the cleanup instructions require that cleanup has to be initiated by an administrator.
If the On-Access policy specifies Automatic cleanup and the item is not cleaned up but Cleanable for an administrator then the cleanup could potentially affect items outside the user's "reach". To rephrase, if On-Access can deal with a detection it usually requires an administrator to make the "final decision".

IMO Power User is a concept (by Microsoft) which never really took off. It's there in Sophos because it's there in Windows. AD restricts local administrators anyway. A Power Users may install programs - for all users, but this is not the point anyway.  Most application nowadays have "mobile" incarnations, so users use whatever they wish - whether a Power User has installed it or not.

So - do you indeed have Power Users who should be able to cleanup/delete quarantined items in lieu of Administrators? To rephrase once more: If with appropriate cleanup settings an item can't be dealt with immediately in the user's context then it requires an administrator.

Christian

Hello Daniel,

thin ice, thin ice. Assuming On-Access detection here. The state in QM and the console (and whether an item ends up in QM) depends on a number of things, first and foremost the settings (automatic cleanup and alternate action). Cleanup is also not a simple scrub this file, it might involve an additional scan of parts of the filesystem and the registry and affect other items as well. I have not investigated whether it makes a difference if the on-access policy just blocks the file (and subsequently it's under QM's control) or the cleanup instructions require that cleanup has to be initiated by an administrator.
If the On-Access policy specifies Automatic cleanup and the item is not cleaned up but Cleanable for an administrator then the cleanup could potentially affect items outside the user's "reach". To rephrase, if On-Access can deal with a detection it usually requires an administrator to make the "final decision".

IMO Power User is a concept (by Microsoft) which never really took off. It's there in Sophos because it's there in Windows. AD restricts local administrators anyway. A Power Users may install programs - for all users, but this is not the point anyway.  Most application nowadays have "mobile" incarnations, so users use whatever they wish - whether a Power User has installed it or not.

So - do you indeed have Power Users who should be able to cleanup/delete quarantined items in lieu of Administrators? To rephrase once more: If with appropriate cleanup settings an item can't be dealt with immediately in the user's context then it requires an administrator.

Christian

Even I faced the same issue as I was not able to delete the file quarantined though I am an admin on my Laptop. I stopped Sophos Agent and Anti-Virus Service to delete the file.

Hello Christian

Okay, thanks for helping me figure it out.

I asume you are right and we have to live with that.

I first tought the Sophos console runs with an system service user (with admin-rights) and the user, if he has permission (SophosPowerUser),

can cleanup infected files that way.

Daniel