ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
frbackup on a Macintosh filling the internal drive with temporary files and cannot be deleted
Article ID: 171459
Data Loss Prevention Endpoint Prevent
While using Time Machine on a Macintosh you find a lot of files fill up the internal hard drive space and cannot be deleted. The same can happen from a USB drive being ejected before DLP is able to scan the files.
DLP needs to process the files being copied. If DLP does not have time to process, DLP copies the files to this frbackup folder for process.
System Integrity Properties (SIP) may be turned on. Time Machine, external hard drive, or a USB drive may be in use.
There are two possible methods to resolve this issue. The first is to shutdown the agent and attempt to delete the files. If the first option doesn't work then uninstall the agent to delete the files.
Method 1: Shutdown the DLP Agent then delete the files
Locate the service_shutdown tool and copy it to the machine. Use chmod as needed (see source KB)
Delete the files in /Library/Manufacture/Endpoint Agent/frbackup
Whitelist time machine application (backupd) as per this KB
Restart the machine when ready to enable DLP agent
Method 2: Uninstall the agent and clean up the files
This method is used if doing method 1 is unable to allow the files to be deleted.
Turn off SIP temporarily and uninstall the endpoint agent on the Macintosh (See Apple KB for more details about Mac OS and SIP). The main steps are to boot into Recovery Mode by restarting your Mac.