Secure Endpoint folder permissions?

[itguy1024]

Hi,

I have seen some failed quarantine events come through and in the details it said access denied. I don't remember AMP needing a service account or setting one up but maybe I'm mistaken. Does AMP have full access to the file systems?

[Troja007]

Hello @itguy1024 ,
yes, Secure Endpoint has full access to the disk, but if the service does not get the right access permission from the Operating System (e.g. running process), this might generate a failed quarantine event. Another option could be, that the file is a temporary file from the browser cache. So when Secure Endpoint wants to remove the file, it is not there any more.
In such a case, we need a closer look how the event looked like.
Greetings,
Thorsten