purge evidence store error in server task log - Failed to access - Permissions?

[McADOC1]

Hi,

Running purge on DLP 11.3.x to purge dlp history of operational events and incidents
i get this error in the server task log

Failed to access: \\mysystemEPO\dpl-data$\evidence\
and
Scan on evidence store \\mysystemEPO\dlp-data$\evidence\ Failed.Failed to access.

what is the best way to troubleshoot to clear error and purge evidence store.
i have the SYSTEM account on the share with read and full control for NTFS.
The share is on the epo server.

Also, there are old and incorrect evidence stores listed in the server task when it searched for stores.  How can i clear those out?

Thanks.

[onedayoneapple · Accepted solution]

The reason you saw incorrect evidence shares in the server task log is because that server task will make tomcat service start to try to access all the evidence share entries used before, even those evidence shares are not being used anymore. there should have a db table store those entries. afaik seems no official documentation to describe how to clear it out.

If you are sure the permission configurations are correct (basically you need to add share permissions for the epo server computer account with full access to the evidence share), looks like the next step is going to review epo orion.log (maybe need to enable debug log for orion to see more details). orion.log is located at epo install dir\server\logs.

[McADOC1]

thanks.

needed computername in share.  had in ntfs only.