App Control: TMP Files Being Left Behind When Saved to a Fileshare

[#1]

Environment

• App Control Agent: Version 8.1.x - 8.9.2
• Microsoft Windows: All Supported Versions

Symptoms

Temporary files generated in a network share are not deleted when the application that generated them is closed.

Cause

Local analysis by the Agent on these renames is preventing remote operations from completing.

Resolution

This issue was tracked under EP-20242 and is resolved in combination of upgrading to Agent 8.9.4+ and creating the following Performance Optimization Rule.

1. Upgrade the Agent on the file server to version 8.9.4 or higher.
2. Log in to the Console and navigate to Rules > Software Rules > Custom.
3. Click Add Custom Rule and use the following details:
   • Rule Name: Ignore TMP Renames On Fileserver (or something memorable)
   • Status: Enabled
   • Platform: Windows
   • Rule Type: Performance Optimization
   • Path or File:

     F:\Specific Path\To\Shared Files\*.tmp

   • Process: Any Process
   • Policies: Selected Policies > Specific Fileserver Policy
4. Click Save & Exit

Additional Notes

This Custom Rule could be locked down further with the use of a Hostname Macro in the Path or File, example:

<OnlyIf:Hostname:*FileServer0?>F:\Specific Path\To\Shared Files\*.tmp

Related Content

App Control: Where to Download Latest App Control Documentation and Installers
App Control: How to Use Wildcards in Custom Rules