This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SAVOnAccess Event ID 769 flooding the Windows 10 Event Viewer

This Error is popping up several times over the day. Not too many for me, but my colleague (who works more with Google Drive File Stream) gets about 15 each second.
Here are the Error details:

- System

- Provider

[Name] SAVOnAccess

- EventID 769

[Qualifiers] 57405

Level 2

Task 0

Keywords 0x80000000000000

- TimeCreated

[SystemTime] 2019-04-02T07:17:57.231122100Z

EventRecordID 9043

Channel System

Security

- EventData

\Device\Harddisk5\DR10

00000400020030000000000001033DE059017602830100C000000000000000000000000000000000010000C0

Any way to fix/minimize this error?

This thread was automatically locked due to age.

0 QC over 5 years ago

Hello Raphael Sauer,

it could be a driver conflict (like mentioned here and also here) although I don't know whether Google Drive File Stream uses a driver (or why you encounter this issue as well) . Do you have Device Control (on-premise)/Peripheral Control (Central) enabled?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Raphael Sauer over 5 years ago in reply to QC

Hey Christian,
thanks but as it turns out, my colleague actually gets Event ID 47 Error. Peripheral Control doesnt help in that case either.
We will be trying this and come back to here if it didn't help.
Cancel
Vote Up 0 Vote Down

Cancel
0 Raphael Sauer over 5 years ago in reply to QC

So,

we tried this but it didn't resolve the issue.

Do you have any idea for another kind of solution?
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 5 years ago in reply to Raphael Sauer

Hello Raphael Sauer,

we tried
you did note the path(s) in SAV.txt and set an exclusion? Or was there no usable path (in either SAV.txt or the Windows Event log)? Could you perhaps show the exclusion(s)?

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Raphael Sauer over 5 years ago in reply to QC

The error was caused by a desktop.ini file in almost every folder, we added a "desktop.ini" file exception but it didnt help
Cancel
Vote Up 0 Vote Down

Cancel
0 QC over 5 years ago in reply to Raphael Sauer

Hello Raphael Sauer,

almost every folder the file system
shouldn't include folders on a regular NTFS file system. Dunno the details but I assume before excluding a particular file the driver assesses the file system so the exclusion must apply to the "root" of the offending file system.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Lee over 4 years ago in reply to QC

Did you guys get this resolved?
I had this issue with one user, appeared out of nowhere, also Google Drive user, company-wide, with Drive File Stream installed and active.

We added an exception for the active scan for drive letter G (G-Drive), and it seemed to work for a little while.
That user has moved onto a new computer, which I also setup, and everything is fine.

Now another new user is having the same issue.

I'm going to attempt to uninstall Sophos and reinstall it.
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Lee over 4 years ago in reply to Mike Lee

Uninstalling, then reinstalling seems to have worked, no SavOnAccess errors when accessing G-Drive files, so far.
It's only been a few mins, but the errors would popup immediately before.

Things are looking up!
Cancel
Vote Up 0 Vote Down

Cancel
0 Mike Lee over 4 years ago in reply to Mike Lee

Too soon...problem still exists.

Event ID 47.
Cancel
Vote Up 0 Vote Down

Cancel