How to enable the On Disk quarantine folder in Protection Engine 8.2.1 and later

Products

• Protection Engine for Cloud Services
• Protection Engine for NAS

Issue/Introduction

The previous Quarantine Server software that was part of the SEP 12.1 product is no longer supported. In order to allow customers to continue to have a quarantine functionality to keep a local copy of an offending file, we now provide the option to enable this.

Resolution

You must enable the OnDisk and set the CloudStore parameters using the xmlmodifier tool. The CloudStore value will be the folder the files are stored in, example "C:\quarantine\folder\".

1. Stop the Protection Engine service
2. Run the following commands from the Protection Engine bin directory:
   xmlmodifier -s //policies/ThreatPolicies/Actions/Quarantine/@value true policy.xml
   xmlmodifier -s //configuration/QuarantineServerSettings/QuarantineType/@value ondisk configuration.xml
   xmlmodifier -s //configuration/QuarantineServerSettings/CloudStore/@relativepath "\opt\SYMCScan\quarantine\" configuration.xml
3. Start the Protection Engine service

References:

Proxy and Quarantine Server

You can then retrieve the quarantined data from the disk using the OnDiskQuarantineManager utility attached below.

Retrieving locally quarantined data from remote computers