topic Re: Harmony Endpoint issue with office files in Endpoint

Harmony Endpoint issue with office files

BrunoCiongoli — Wed, 09 Feb 2022 14:09:04 GMT

We are making our first steps with Harmony Endpoint and we are facing some issues

When we try to open an office file with the endpoint client enabled, it does not allow me to open it (attached image)

If we disable the anti-malware blade I can open it without any problem

Aditional information:

-The client is in version E86.00

-all the clients are running in windows 10, in the same domain

-The files are extension XLSX

Someone knows what can occur?

Re: Harmony Endpoint issue with office files

J_B — Thu, 10 Feb 2022 13:43:15 GMT

Does this happen with any MS Office file, word, excel, or is it just Excel files? If it's just with Excel files, do these files have any macros or VB Scripts in them which endpoint could see as malware?

Also does this happen if you open the file from within the MS Office application and also if you open the file directly from windows explorer?

Do you see any errors in the log files, or does the malware blade show any infections?

Can you translate the error that you see into English?

Re: Harmony Endpoint issue with office files

Chris_Atkinson — Thu, 10 Feb 2022 14:24:56 GMT

Please pilot E86.20 and advise the result.

Re: Harmony Endpoint issue with office files

the_rock — Thu, 10 Feb 2022 14:28:40 GMT

Might be worth check with TAC, but I agree with Chris, E86.20 is good option, as it is newest client and seems to work really well.

Re: Harmony Endpoint issue with office files

BrunoCiongoli — Thu, 10 Feb 2022 14:33:47 GMT

Hi J_B, thank you for your response.

there are also some ".docx" documents too, but most are ".xlsx". Some of this documents do have macros and others do not. But if necessary, how can I allow macros or VBS's to normally run in the documents?

Regarding the location or the app from which the files are being opened and the logs, I need to get back to the client to verify.
What I can confirm, is that the same file failing to open on a mapped network drive, opens without issues from a local drive.

I´ve just realized the error message in spanish. I´ve cropped the screenshot and pasted here without checking that 🙂

The error says
Could not find "K:\Path\ABCD.XLSX". Check your spelling or try a different path.

Re: Harmony Endpoint issue with office files

K_montalvo — Thu, 10 Feb 2022 15:58:29 GMT

86.01.1005 is the recommended version to use, also if necessary you can start here https://www.udemy.com/share/104WGC3@7Strm2-BCtfptNMk_AR_Pp3tgQt9fouJtmawKOSTJqQ4aoP-FMv4lWIAJiq5vkIF/

Re: Harmony Endpoint issue with office files

BrunoCiongoli — Thu, 10 Feb 2022 16:48:45 GMT

Thank you for your response Chris

Re: Harmony Endpoint issue with office files

BrunoCiongoli — Thu, 10 Feb 2022 16:49:18 GMT

Thank you for your response.

Re: Harmony Endpoint issue with office files

BrunoCiongoli — Thu, 10 Feb 2022 18:01:51 GMT

Hi J_B, I add to the previous response that if I open the file from within the MS Office application and also if I open the file directly from windows explorer the error also occurs

There are no errors in the logs and the anti malware blade does not have any infections related to the mentioned files.

Re: Harmony Endpoint issue with office files

BrunoCiongoli — Tue, 15 Feb 2022 18:55:41 GMT

Hi Chris

We tried with 86.20 and what happens now is that it allows to open the file, but the following error appears when we try to modify the file:

"File blocked. Try it again"

Re: Harmony Endpoint issue with office files

J_B — Tue, 15 Feb 2022 19:42:11 GMT

Is the "File blocked. Try it again" error message being generated from Windows/MS Office, or is it a Check Point dialogue box error message?

When you open the file and try to modify it are you seeing anything in the check point logs on the client device? 'Right click padlock' -> 'Display Overview' -> 'Advanced' -> 'View Logs'

I'm assuming the users have write permission to the files that they're trying to modify?

You mentioned that it works if the Anti-Malware blade is disabled, I'm looking at the Anti-Malware policy and there isn't really much in there that you can configure. One thing you could try is in the 'Scan all files upon access' is to add in and exclude one of the files that you're trying to modify. You might be able to add a wild card for all .xlsx or .docx - Someone else may be able to confirm if that policy allows wildcards. At least that would help to identify if it's that part of the policy that is blocking the access.

We're running E86.10 and I've not seen any issues like you've described.

Re: Harmony Endpoint issue with office files

jcortez — Thu, 17 Feb 2022 14:21:52 GMT

@BrunoCiongoli

Please open a SR/Case with our TAC Endpoint Team. This would be the best way forward. We wouldn't be able to properly troubleshoot here.

Also, yes our current recommended client is E86.01 but I would suggest using E86.20. And coming very soon our new recommended client will be E86.25 since our E86.01 client has a number of issues/bugs in regards to MS Documents and Files working with our SBA/Threat Prevention Blades.

Re: Harmony Endpoint issue with office files

Chris_Atkinson — Mon, 07 Mar 2022 15:45:51 GMT

As @jcortez mentioned was coming, E86.25 is now available per sk177584.