DLP Network Discover scan incident count varies when scanning the same PST file

Products

• Data Loss Prevention Network Discover

Issue/Introduction

You are running a Symantec Data Loss Prevention (DLP) Network Discover scan of a PST file.

Each time you run a full scan of the same PST file the incident count is different and you are expecting the incident count to be the same for each scan.

You may see errors in the file reader log on the Discover server

 

 

 

Environment

DLP 15.8 and 16.x

Windows 2016 Server

Outlook 2016

Cause

Windows Defender is installed on the Discover server and does not have any exceptions configured for DLP.

Resolution

We recommend installing antivirus software on Symantec Data Loss Prevention servers. However, antivirus software may interpret DLP activity as virus-like behavior. Therefore, certain files and directories must be excluded from antivirus scans. 
Please refer to the article, Servers with Antivirus and Symantec Data Loss Prevention (DLP) Server Software for steps on how to exclude DLP from any antivirus.