ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Changing all .bad incidents to .idc on a Windows operating system

book

Article ID: 163644

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

Due to varied circumstances, the incidents directory on a Windows Data Loss Prevention (DLP) Enforce server may become filled with queued incidents modified with the .bad extension.  This extension signifies a failure of Data Loss Prevention to process the incidents (for any number of reasons).  Through troubleshooting, it may become advantageous to reattempt the processing of the '.bad' incidents.  To fully realize this goal, an administrator may need to change a large quantity of incidents back to '.idc'.

Resolution

The attached script (resetIDC.bat) will allow for a large scale change of '.bad' extensions to '.idc'.  To implement the script, follow these instructions:

DLP 15.1 and later

  1. Download the script and move it into the "C:\ProgramData\Symantec\Data Loss Prevention\Server Platform Common\15.1\incidents" directory on the Enforce server.  This path may vary depending on the installation.
  2. Run the script as Administrator.

DLP 15.0 and previous

  1. Download the script and move it into the "C:\SymantecDLP\Protect\incidents\" directory on the Enforce server.  This path may vary depending on the installation.
  2. Run the script as Administrator.

The script may take some time to run.  If too many incidents are added back into the environment, restarting IncidentPersister may be necessary to process batches of the reattempting incidents.  If incidents are still actively being changed to '.bad', address whatever outstanding issue still exists in the environment before reattempting a bulk extension change.

Attachments

resetIDC.bat get_app