The host of Evidence and Whitelist shared folders experience traffic on port 445 from endpoints

Technical Articles ID: KB90025
Last Modified: 12/22/2021

Environment

McAfee Data Loss Prevention (DLP) Endpoint – all supported versions

For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.

Problem

The host of the Evidence and Whitelist shared folders experiences many connections made on port 445 by DLP Endpoint client systems.

Cause

The Data Protection Rule was triggered on the endpoints. The rule caused the Evidence and Whitelist shared folders host connections to be made. After the connection is established, the clients upload files to the shared folders. These files are the Evidence files, Whitelist files, or both.

Solution

This behavior is considered normal and by design. For more information, see Network Ports Used by Key Microsoft Server Products.

Affected Products

Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.4.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

The host of Evidence and Whitelist shared folders experience traffic on port 445 from endpoints

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

The host of Evidence and Whitelist shared folders experience traffic on port 445 from endpoints

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title