What Logs show "Access Denied" Error Message Details

To find the specific details of an "Access Denied" error, you need to look at different logs depending on whether you want a high-level summary or a deep technical root cause.

Here are the 3 primary places to look:

1. The Spirion Console (High-Level Summary)

This is the first place to check for a quick overview of which files failed.

Where to look: Navigate to Scans > All Scans > Click on your specific Scan Name > Status tab.
What to look for: Look for a status of "Done, With Results, Errors".
The Detail: Click on the "Errors" count. It will provide a table showing the specific File Path and a brief error message like Access to the path '...' is denied.

2. The Agent Log (Deep Technical Detail)

If the Console message is too vague, the local Agent log provides the exact Windows error code and the context of what the agent was doing when it was blocked.

Where to find it (Windows): C:\ProgramData\Spirion\Logs\
File Name: Look for the log file corresponding to the date of the scan (e.g., Agent_YYYY-MM-DD.log).
What to search for: Search the text file for the keyword "Denied" or "Error 5".
- Note: Error 5 is the standard Windows system error code for "Access is Denied."
Why this is better: The agent log will tell you if the error happened during the Open (Discovery), Write (Classification), or Move (Quarantine) phase.

3. The Windows Event Viewer (Environmental Context)

If the Spirion logs show "Access Denied" but your permissions look correct, the Windows operating system logs might show if a third-party tool (like Antivirus) blocked the action.

Where to look: Open Event Viewer on the machine where the Agent is running.
Logs to check:
- Windows Logs > Security: Look for "Audit Failure" events. This will confirm if the Service Account was blocked by an NTFS ACL.
- Windows Logs > System: Look for errors related to the "Spirion Agent Service."
- Applications and Services Logs: Check your Antivirus or EDR logs (e.g., CrowdStrike, SentinelOne, Windows Defender). These logs will often show if they "Quarantined" or "Blocked" the Spirion process because it was opening too many files too quickly.

How to Interpret the Log Findings

Log Message	Likely Meaning
`Access to the path is denied`	The Service Account lacks NTFS Read or List permissions.
`Error writing attributes`	The Agent has Read access but lacks Write Attributes (needed for Classification).
`The process cannot access the file because it is being used by another process`	This is a File Lock (e.g., an open Outlook PST or Database file), not a permission issue.
`Access Denied` (followed by an EDR name)	Your Antivirus/EDR is blocking Spirion. You need to add an exclusion for `spirion.exe`.

Tip: Using the "Log Level"

If you are troubleshooting a persistent "Access Denied" issue that doesn't make sense, you can temporarily increase the Log Level in the Agent Settings to "Trace" or "Debug". This will record every single file interaction, allowing you to see exactly which permission check failed. (Remember to set it back to "Info" after testing to save disk space!)

Summary

Start with the Console Errors to see which files are failing, then go to the Local Agent Log in C:\ProgramData\Spirion\Logs\ to find the specific Windows error code.