Discover Scan will not start - Error 5

Products

• Data Loss Prevention Network Discover
• Data Loss Prevention

Issue/Introduction

A Discover scan will not start and errors out.

The customer has the proper credentials and access to the file share, yet the scan will not start.

The following error may appear in the DLP Enforce console in the Scan Detail screen:

WARNING: Failed to read \\servername\fileshare; error: CreateProcess: C:\<path to>\Protect\bin\smb.bat l: "\\servername\fileshare" "Domain\scanner_user" <password> error=5

Note:
The default path to the smb.bat is "C:\Program Files\Symantec\DataLossPrevention\ServerPlatformCommon\<version>\Protect\bin\".

Resolution

There are a couple of solutions to this issue:

Solution 1 (preferred solution):

1.  On the Detection Server, go to C:\WINDOWS\system32, go to properties for cmd.exe and then security tab. 
2.  Verify that SERVICE has access to it.  Make sure it has read & execute and read permissions 
3.  You may have to add SERVICE and give it the permissions as described in step 2.
4.  Restart the Symantec DLP Detection Server service before running another scan.

Solution 2:

Add the user running the Symantec DLP Detection Server service on this Discover server to the Local Admin group.

 

This affects all versions.