What are the folders in C:\Users\SymantecDLP\AppData\Local\Temp\DetectionServerContentExtractionTemporary used for?

Products

• Data Loss Prevention

Issue/Introduction

The folder C:\Users\SymantecDLP\AppData\Local\Temp\DetectionServerContentExtractionTemporary which contains 2 subfolders, "\keyview" and "\mip", is created when the Detection Server service is started or when specifically the FileReader process is started. It is used primarily as the temporary location for it to process user data and then automatically removes it when the process is completed. This folder persists as long as the Detection Server service or FileReader is running. The folder would only be deleted when the Detection Server service or FileReader is stopped.

Environment

DLP versions prior to 16.1

Resolution

Data Loss Prevention will create only temp files to this location. There is no special permission applied to this folder. In case this is a security concern then you may restrict access for the users to access this directory. To avoid false positive detection, you can add exceptions into the AV software to exclude this location.