Unable to read / write Microsoft Office files on NAS due to access denied erros.

Products

• Protection Engine for Cloud Services
• Scan Engine
• AntiVirus for Caching
• Protection for SharePoint Servers
• Protection Engine for NAS

Issue/Introduction

When reading / writing Microsoft Office files on NAS, you run into an access denied error. At same time, the following error message can be seen in Application Log on Symantec Scan Engine (SSE) / Symantec Protection Engine (SPE) system:

The Scan Engine has encountered a scan error
Date/time of event = 2013-05-13 15:49:24
Event Severity Level = Error
Scanner = Decomposer
Result ID = 37
URL = no_path
File name = XX.zip
Client IP = X.X.X.X
Scan Duration (sec) = 0.000
Connect Duration (sec) = 43.243
Scan Engine IP address = X.X.X.X
Scan Engine Port number = 1344
Uptime (in seconds) = 44922

or 

Wed Aug 31 13:18:09 JST 2016
The Symantec Protection Engine has encountered a scan error
Event Severity Level = Error
Scanner = Generic
Result ID = 6
File name = \\x.x.x.x\ONTAP_ADMIN$\vol\vol1\xxxxxxx.tmp
Client SID = S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxxxx
Client IP = x.x.x.x
Scan Duration (sec) = 0.000
Connect Duration (sec) = 0.000
Symantec Protection Engine IP address = x.x.x.x
Symantec Protection Engine Port number = 0
Uptime (in seconds) = 660

This error could be observed in (but possibly is not limited to) integration of SSE / SPE with EMC Celerra / EMC VNX / NetApp DateONTAP systems.

 

Cause

Errors are related to an issue with meta data caching on SMB2-clients like SSE / SPE, possibly caused by the SMB2 redirector using Directory caching.
 

Resolution

1. Please make sure following key doesn't exist (as it disables SMB2):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters] "Smb2"=dword:00000000

2. Set the following registry keys on all SSE/SPE servers:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanworkstation\Parameters
FileInfoCacheLifetime DWORD_32Bit 0
FileNotFoundCacheLifetime DWORD_32Bit 0
DirectoryCacheLifetime DWORD_32Bit 0
 

When done, please reboot SSE / SPE system(s). Please be aware this change is likely to increase traffic between NAS and SSE / SPE systems.