Discover scan sometimes looses the attribute file owner - unknown is populated instead

Products

• Data Loss Prevention Network Discover

Issue/Introduction

When we run a test Discover scan the file owner attribute sometimes shows as unknown rather than the file owner.

In the logs we found 

Level: WARNING
Message:  Native informations of file 'w:\filename.pptx' couldn't be retrieved: LookupAccountSid calculating account name length: Access is denied.

And we can correlate this error via time and filename to all of the incidents with unknown file owner attribute.

Environment

Release : 15.8

Cause

Upon further testing, we found that the error was inconsistent, some of the scans presented this error whereas others worked just fine.

Upon additional testing, it was found that the error only occurred when the user immediately kicked off a second scan, right after the first had finished.

 

The cause was that the file server holding the share had not yet cleared the file lock from the previous scan.

It was found this only happens on small test scans.

Larger scans will generally clear the lock long before we can try to restart the scan.

Resolution

In this case, as it is a testing situation, the recommendation is to either wait a couple of minutes, or create a secondary share and a secondary Discover scan.

You can then alternate back and forth between the two. this will allow you to keep testing while allowing enough time for the file share server to clear the lock.