Quarantine Failure Reason: insufficient permissions during endpoint discover

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

When running an endpoint discover there is an incident created but the quarantine fails with "insufficient permissions" error.

Environment

15.x 

16.x

Cause

This is usually caused when the Endpoint Discover: Quarantine File response rule is configured to use a network path and that path does not have the Everyone group configured for full control.

Resolution

Modify the network share and add the Everyone group with full control permissions.