topic Re: Deleting a quarantined file in Endpoint

Deleting a quarantined file

64Bit — Wed, 27 May 2020 16:24:42 GMT

What's the best way to remotely delete files that have been quarantined?

In R80.20 SmartEndpoint UI there is a restore file option but no delete file option.

The above image shows options for Anti-Malware blade but there can be quarantined files from other blades like Threat Emulation. Where would we be able to remotely delete these quarantined files?

I understand restoring files can be done from the client machine but we wouldn't always have access, especially for those devices within different timezone to us. Remote management is also more suitable as it's less disruption to the users workday.

Re: Deleting a quarantined file

PhoneBoy — Fri, 29 May 2020 19:16:52 GMT

I don't believe we have the ability to remotely delete files.
I'm assuming you're referring to files in quarantine here, correct?

Re: Deleting a quarantined file

64Bit — Tue, 02 Jun 2020 08:13:14 GMT

Hey PhoneBoy, thanks for your reply.

Yes files in quarantine, I'm guessing that irrespective of the blade that quarantined the files they are stored locally on the host in C:\ProgramData\CheckPoint\Endpoint Security\Remediation\Quarantine ?

Is there a setting to automatically remove quarantined after a specific date ?

Re: Deleting a quarantined file

PhoneBoy — Thu, 11 Jun 2020 02:06:14 GMT

That looks correct.
In the Default File Quarantine Settings, files are kept in quarantine for 90 days and users can permanently delete items from quarantine.
You can further configure this.

Also, there does appear to be a utility (referred to as "SandBlast Agent Quarantine Manager for Administrators") that will allow remote deletion.
Search SupportCenter and download the version relevant version:

Re: Deleting a quarantined file

64Bit — Thu, 11 Jun 2020 09:11:12 GMT

The Default File Quarantine Settings is part of the Forensics Blade, am i right to assume that it doesn't affect files quarantined by other blades, like Anti-Malware for example?

We have used "SandBlast Agent Quarantine Manager for Administrators" and this can manually delete files from %ProgramData%\CheckPoint\Endpoint Security\Remediation\Quarantine i take it this has to be used from the host machine?
Many thanks for your reply Phone Boy.

Re: Deleting a quarantined file

PhoneBoy — Thu, 11 Jun 2020 19:56:33 GMT

I assume it's the same quarantine used for both.
The SBA Quarantine Manager for Administrators can theoretically run on any machine and an admin can remove files from quarantine for other machines.
A user can also potentially run it for themselves as well.

Re: Deleting a quarantined file

Daniel_Kavan — Thu, 15 Jul 2021 16:10:28 GMT

Hi mates,

Is there any change to this solution RE: Endpoint Security? I have a user who wants to delete a Quarantined file but doesn't see the Quarantine folder.

C:\ProgramFiles(x86)\CheckPoint\Endpoint Security\Remediation\Quarantine