AIP scanner destroy files

Question

AIP scanner destroy files

Kunimünch Sascha 20

Hello everyone,

we have had the problem twice now that the AIP scanner damaged our local data.

Our data is on a NAS and our two AIP scanners are set to always scan. Earlier this year I rebooted the NAS for updates. After that, more and more users came to me that they have Office files (xlsx, docx, pptx) that are only 1kb in size and can therefore no longer be opened. After a short check, I was able to trace the phenomenon back to the restart in question.

Now I shut down the AIP scanners in the vCenter this WE and had the same problem again.

Is this behavior known? Is there anything I can adjust or do to keep it from happening again?

Thank you for your help and best regards, Sascha

Givary-MSFT 35,771 Reputation points Microsoft Employee Moderator

2023-07-04T04:19:46.02+00:00

@Kunimünch Sascha Apologies for the delayed response on this issue, let me research on your ask and revert back.

Answer accepted by question author

0 additional answers

Your answer

Givary-MSFT 35,771 Reputation points Microsoft Employee Moderator

2023-07-04T04:19:46.02+00:00

@Kunimünch Sascha Apologies for the delayed response on this issue, let me research on your ask and revert back.

Answer 1

Givary-MSFT 35,771 Microsoft Employee Moderator

@Kunimünch Sascha Discussed your above mentioned scenario with my team, they suggested the following approach - need to stop the scanner before rebooting the NAS. otherwise it will corrupt the files. It is never recommended to interrupt a scan while its processing files. If you have a planned activity with rebooting the NAS then also stop the scan and we can check it is really done by running Get-AIPScannerStatus

Let me know if you have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Kunimünch Sascha 20 Reputation points

2023-07-05T08:51:08.3666667+00:00

Hello Givary,

thanks for your clarifications. So it doesn't matter if I shut down the server or the NAS, I always have to shut down the scanner first?

What is the best way to end the scan? Just stop the service?

Greetings, Sascha
Givary-MSFT 35,771 Reputation points Microsoft Employee Moderator

2023-07-05T09:02:25.3933333+00:00

@Kunimünch Sascha Before rebooting NAS server, always recommended to stop the AIP scanner process - https://learn.microsoft.com/en-us/powershell/module/azureinformationprotection/stop-aipscan?view=azureipps and verify the same using Get-AIPScannerStatus - https://learn.microsoft.com/en-us/powershell/module/azureinformationprotection/get-aipscannerstatus?view=azureipps

Reference: https://learn.microsoft.com/en-us/microsoft-365/compliance/deploy-scanner-manage?view=o365-worldwide

Let me know if you have any further questions, feel free to post back.
Kunimünch Sascha 20 Reputation points

2023-07-05T09:43:41.1533333+00:00

Thank you very much.

Share via

AIP scanner destroy files

0 additional answers

Your answer