2 strange behaviors (Honeypot Files & SandBlastBackup)

Robert_Mueller — Fri, 20 Apr 2018 06:19:46 GMT

Hi,

We use as EPS Client the E80.72 and since then we have 2 strange behaviors of the client..

In the c:\Users directory where the honepot files for the Anti-Ransomeware blade are stored there are a large amount of these folders (see attachment) - this couldn't be normal? (Anti-Ransomeware is disabled in the policy)

And the second question.. is it possible to limit the size of the folder c:\SandBlastBackup - on some clients this directory is about 20GB?!

Robert

Re: 2 strange behaviors (Honeypot Files & SandBlastBackup)

Steve_Lander — Fri, 20 Apr 2018 15:18:19 GMT

I don't think that looks normal. We have everything enabled and there is not much in the SandBlastBackup folder, mine is around 14mb. My profile folders such as Documents and Music folders only have 1 honeypot folder in them each. I would try testing E80.82 which is the newest release and seems to fix a lot of things. We went straight from E80.70 to E80.80 and E80.82 without ever testing E80.72 so maybe there is something in that release that doesn't work too well in the Anti-Ransomware Blade.

You can change the max size of the SandBlastBackup folder in the Anti-Ransomware settings on the Management Server to see if that reduces the size? You can also change individual file type max sizes in the advanced option circled. 20GB is a bit high.

topic 2 strange behaviors (Honeypot Files & SandBlastBackup) in Endpoint

2 strange behaviors (Honeypot Files & SandBlastBackup)

Re: 2 strange behaviors (Honeypot Files & SandBlastBackup)