Wiki source code of Quarantäne

Last modified by S V on 2023/03/08 11:37
Show last authors
1 {{aagon.priorisierung}}
2 40
3 {{/aagon.priorisierung}}
4
5 {{aagon.floatingbox/}}
6
7 Files that are detected by the Microsoft Defender anti-virus scanner as a real or possible threat are automatically moved to Quarantine. The administrator can then decide what to do with the file. It can be left in quarantine until it is automatically deleted, or, if it is a false alarm, it can be removed from quarantine using a recovery job. If the false alarm is a regular occurrence, you can also add the file to an exclusion so that it is no longer automatically quarantined.
8
9 {{figure}}
10 (% style="text-align:center" %)
11 [[image:53_64_Security_Defender Management_Quarantäne_1814.png||alt="Quarantäne.PNG"]]
12
13 {{figureCaption}}
14 Tab Quarantine
15 {{/figureCaption}}
16 {{/figure}}
17
18 = Viewing quarantined files =
19
20 All files that have been quarantined on the Client can be viewed in a list on the //Quarantine// tab. They are listed according to how recently they were quarantined.
21
22 Each quarantine entry has the following properties:
23
24 |File path|File name and file path
25 |Threat|Detected threat that caused the file to be quarantined
26 |Severity|Warning level of the threat, which itself can be divided into 4 levels: high, medium, low and unknown.
27 |Status|(((
28 Status of the quarantine entry, which is divided into 5 statuses:
29
30 ~1. //In Quarantine//
31
32 The file is in quarantine on the client.
33
34 2. //Restore requested//
35
36 A restore job has been started and is in progress.
37
38 3. //Failed//
39
40 Appears when a restore job has failed. The exact error can be viewed in the logs on the ribbon bar under Job Monitor.
41
42 4. //Was in quarantine//
43
44 The file no longer exists on the Client, e.g. it has been deleted from Quarantine.
45
46 5. //Restored//
47
48 The restore job was successful and the file has been restored.
49 )))
50 |Time of detection|Date and time the file was moved to quarantine
51 |Restoring user|Administrator who restored the file
52 |Recovery date|Date the quarantined file was restored
53 |Category|Classification of the quarantined file, e.g. virus, worm, Trojan, etc.
54 |Recovery reason|Reason for restoring the file, optionally entered by the administrator
55 |Continuing information|Link to further information
56
57 You can also view these properties in the Client Details or use them as fields in queries and reports.
58
59 You can also select each quarantine item individually and view more detailed quarantine item details.
60
61 == Restoring files ==
62
63 Files that have been quarantined by mistake, but are safe, can be moved out of quarantine using a restore job. To do this, select the required item from the quarantine items and click //Restore// in the ribbon bar. In the meantime, the file will have the status 'Restore requested'. If the restore was successful, it will have the status 'Restored'; if the restore failed, it will have the status 'Error'. You can then see the exact error in the Job Monitor. If a file keeps ending up in Quarantine by mistake, you can add it to an exclusion.
64
65 == Adding exclusions for specific files ==
66
67 If you find that a particular file is repeatedly mistakenly detected as a threat by the Windows Defender Scanner, you can add it to an exclusion.
68
69 From the //Quarantine// tab on the ribbon bar, use //Add exclusion// to decide which item to add to the exclusion. You can choose to exclude specific files, file extensions, entire directories, or processes. The file will no longer be automatically moved to Quarantine.
70
71 == Deleting quarantined items from the Client ==
72
73 {{aagon.infobox}}
74 Please note that deleting a quarantined file as a remote action for the Client is not supported by Microsoft.
75 {{/aagon.infobox}}
76
77 However, you have the option in ACMP to run an automated delete action on obsolete quarantine files after a specified period of time. To do this, go to the //Configuration Profiles// > //Real-time protection// tab. Under //Quarantine//, you can then set the time after which a file is automatically deleted from quarantine. The default setting is 40 days.
78
79 The effect of this setting is that quarantined files are considered obsolete after the specified period and are automatically removed from the Client without any further action by the Administrator.
80
81 == **Deprecating quarantine files from the ACMP database** ==
82
83 Once quarantined files have been restored to the Client or automatically deleted, they are given the status of 'Restored' or 'Was in Quarantine'. The associated metadata remains in the ACMP database for a period of time. This allows administrators to use these entries to track information beyond file deletion, even if the quarantine file no longer exists on the client.
84
85 These quarantine entries are later deleted from the ACMP database via a cleanup job. Here you can set both the time period after which these entries are deleted and the general interval at which the cleanup job runs on the server. To do this, go to //System// > //Settings// in the navigation. Under //Scheduled Server Tasks //in the //ACMP Server// root level, you will find the //Defender Events cleanup// under //Defender Management//. By default, this cleanup starts every 5 hours and deletes items in the database that are older than 30 days. You can change the default settings by double-clicking on the entry in the wizard that appears and setting the desired time periods.
86
87 {{aagon.infobox}}
88 Only quarantine items with the status 'Was in quarantine' or 'Restored' will be deleted. Entries for files that are still in quarantine are not deleted.
89 {{/aagon.infobox}}

Navigation

© Aagon GmbH 2024
Besuchen Sie unsere neue Aagon-Community