Event ID 8215 — File Screen Enforcement

Applies To: Windows Server 2008

You can create file screens to prevent users from saving unauthorized files on volumes or folders. There are two types of file screen enforcement: active and passive enforcement. Active file screen enforcement does not allow the user to save an unauthorized file. Passive file screen enforcement allows the user to save the file, but notifies the user that the file is not an authorized file. You can configure notifications, such as events logged to the event log or e-mails sent to users and administrators, as part of active and passive file screen enforcement.

Event Details

Resolve

Review the event log message and take appropriate action

You can configure File Server Resource Manager (FSRM) to log an event when a user has attempted to save an unauthorized file to a volume or folder that is under file screening management. The event log message will report values specific to the user action, depending on the variables specified in File Server Resource Manager when the event alert is configured (for example, the name and e-mail address of the user, and the name of the unauthorized file). You can use the information reported in the event log message to take appropriate action, according to the storage policies of your organization.

If you would like to change the text or the values that will be reported in the event log message, you must change the notification properties of the file screen. If the file screen derives from a file screen template, and you want to change the event notification for all file screens that derive from that template, you can make the changes to the file screen template and then apply the changes to all file screens that derive from it.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To change the notification properties of a file screen template or of a specific file screen:

1. Open File Server Resource Manager. Click Start, point to All Programs, click Administrative Tools, and then click File Server Resource Manager.

2. To list all currently configured file screens, in the console tree, under File Screening Management, click File Screens.

3. If you want to modify the template a file screen derives from and apply the changes to other file screens that derive from that template:

   1. Identify the template that was used to create the file screen. The name of the template is listed in the Source Template column. If there is no template listed, you need to modify the specific file screen instead.
   2. Ensure that the value in the Match Template column is Yes. If the value is No, you need to modify the specific file screen instead.
   3. In the console tree, click File Screen Templates, right-click the template that you identified, and then click Edit Template Properties.

   --Or--

   If you want to modify a specific file screen and not the template that it derives from, right-click the file screen, and then click Edit File Screen Properties.

4. To change the text and the variables in an event notification:

   1. To change the text in the event log message, on the Event Log tab, edit the text under Log entry.
   2. To add a variable, place the cursor where you want the variable to be added to the text, select the variable from the drop-down list, and then click Insert Variable. If you want to remove a variable, delete it from the text.
   3. Click OK to save the new event notification text.

   Note: If you want to remove the event notification instead of changing it, on the Event Log tab, clear the Send warning to event log check box.

5. Click OK to save the changes to the file screen template or to the specific file screen.

6. If you modified a file screen template, the Update File Screens Derived from Template dialog box will open. Select whether to apply the changes to all file screens that derive from the template, or only to those that still match the original template, and click OK.

Verify

To verify that file screen enforcement is working properly, try to save an unauthorized file in a folder or volume that is screened by File Server Resource Manager (FSRM).

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To see the list of configured file screens and the type of files that they block:

1. Open File Server Resource Manager. Click Start, point to All Programs, click Administrative Tools, and then click File Server Resource Manager.
2. In the console tree, expand the File Screening Management node, and then click File Screens. The results pane will show all configured file screens, and the details for each:
   • The File Screen Path column shows the volume or folder where the file screen is enforced. Use this information to determine a volume or folder where you can try to save the unauthorized file.
   • The Screening Type column shows the type of file screen. If available, select an active file screen for your verification.
   • The File Groups column shows the file groups defined for the file screen. If you want to see more details about each file group, on the console tree, click File Groups.

Related Management Information

File Screen Enforcement

File Services