What Causes "Access Denied" Errors?

Here are the most common causes, categorized by where the blockage occurs:

1. Insufficient NTFS or Share Permissions

This is the #1 cause of "Access Denied" errors.

• The "Most Restrictive" Rule: For network shares, Windows combines Share Permissions and NTFS Permissions. If the Share is set to "Read Only" but the NTFS folder is "Full Control," the Agent will still be blocked from performing a Quarantine or Classification action because "Read Only" is the most restrictive.
• Missing "Write Attributes": If you are trying to perform NTFS Classification, the Agent needs the "Write Attributes" permission. If it only has "Read," the scan will find the data but fail to apply the label, resulting in an error.
• Service Account Identity: If you are scanning a remote share, ensure the Service Account configured in the Spirion Console has been granted access to that specific path.

2. File System Locks (Files in Use)

If another application has a file open with an "Exclusive Lock," the operating system will deny Spirion access.

• Common Culprits: Outlook PST files (if Outlook is open), active database flat files (like .mdf or .ldf), or log files currently being written to by a system process.
• Note: Spirion is designed to be non-intrusive. If it encounters a locked file, it will typically skip it and report an error rather than risk corrupting the file by forcing it open.

3. Security Software Interference (AV/EDR)

Antivirus or Endpoint Detection and Response (EDR) tools may view the Spirion Agent's behavior as suspicious.

• Behavioral Blocking: Because the Spirion Agent rapidly opens thousands of files and (if configured) modifies their metadata or moves them, an EDR might flag it as "Ransomware-like" behavior and kill the process or block the file access.
• Solution: You should whitelist/exclude the Spirion Agent executable (spirion.exe or Agent.exe) and its working directories from your security software's real-time inspection.

4. Environmental & Network Constraints

• Offline Files / Stub Files: If you are scanning a location that uses "Cloud Tiering" (like OneDrive or certain SAN storage), the file might only exist as a "stub." If the Agent tries to read it and the system cannot "re-hydrate" the file from the cloud (due to network issues), it may return an "Access Denied" or "File Not Found" error.
• Read-Only Media: Attempting to classify or redact data on a CD-ROM, a write-protected USB drive, or a Read-Only snapshot on a storage array will always result in an Access Denied error.

5. Specialized Windows Protections

• UAC (User Account Control): If the Agent is running as a standard user rather than a Service Account or SYSTEM, Windows may block access to protected directories like C:\Windows or C:\Users\Administrator.
• AFL (Access Control Lists) on System Folders: Even the SYSTEM account is sometimes blocked from specific "Owner-Only" folders unless permissions are explicitly modified.

How to Troubleshoot "Access Denied"

If you see these errors in your scan results:

1. Identify the Path: Look at the Scan Status details to see exactly which file path failed.
2. Test the Identity: Log into a machine using the same Service Account used for the scan and try to manually open that file or create a new text file in that folder. If you can't do it manually, the Agent can't do it either.
3. Check the Agent Log: Review the local Agent logs (typically in C:\ProgramData\Spirion\) for the specific Windows Error Code (for example, Error 5 is the standard Windows code for Access Denied).
4. Verify Remediation Permissions: If the scan finds data but fails to Quarantine, ensure the Agent has permissions on both the Source folder and the Destination folder.

Summary

Most "Access Denied" errors are caused by Share/NTFS permission mismatches, locked files, or security software (AV/EDR) blocking the Agent's activity.