NetWitness Community

ChrisIchelson · ‎2021-12-09

Does the Netwitness Endpoint Agent stop any processes from processing if you haven't manually blocked the file?

Seeing this in the logs of one of our files:

Could not copy "obj\Debug\xxxxxxxxxxxxxxxxx.exe" to "bin\Debug\xxxxxxxxxxxxxxxxxx.exe". Exceeded retry count of 10. Failed. The file is locked by: "RSA NWE Agent (4220)"

ChrisIchelson · ‎2021-12-10

Thank you for this info. This client was running the 11.5 agent. We had them remove the 11.5 and install the 11.6.1 agent and this problem is resolved.

I think the issue becomes that the agent needs to stay up to date. With the new releases of the NW Agent, you can now update from the dashboard. I explained this to the client. Thank you for the response.

View solution in original post

Anonymous · ‎2021-12-10

No, it doesn't. Only files, which have been added to the blocking list are actively blocked.
This however looks to be related to Visual Studio development. iirc I saw this happening at one of my customers.

Plesae open a support ticket and specify the version of the agent, which you are using. They will help you isolating this.

ChrisIchelson · ‎2021-12-10

Thank you for this info. This client was running the 11.5 agent. We had them remove the 11.5 and install the 11.6.1 agent and this problem is resolved.

I think the issue becomes that the agent needs to stay up to date. With the new releases of the NW Agent, you can now update from the dashboard. I explained this to the client. Thank you for the response.