Does Data Center Security (DCS) Windows Agent use symefasi64.sys driver?

Products

• Data Center Security Server Advanced

Issue/Introduction

You would like to know if DCS Windows Agent uses symefasi64.sys driver and if not, if it can be safely removed from the OS.

Environment

DCS 6.9.x and 6.10.x.

Resolution

Symefasi64.sys is an integral component of DCS 6.9.3 and 6.10 Windows Agent.

File location: C:\Windows\System32\drivers\symefasi\<....>\

The driver is required to manage Extended File Attributes metadata and is used to verify if the launched process is signed and trusted along with other activities related to security processing and scanning.

Removing the driver will affect DCS Agent functionality and we recommend against it.