Quarantine file

You can quarantine files that you consider dangerous to your device:

• Using the Quarantine a file task.
• On the command line.
• From the alert details window.

Moving files to quarantine is available only if integration with the Kaspersky Endpoint Detection and Response Optimum solution is enabled and the EDR Optimum component is activated. Restoring and deleting files from quarantine is available regardless of whether integration with Kaspersky Endpoint Detection and Response Optimum is enabled and the EDR Optimum component is enabled.

You can create and run a Quarantine file task for all managed devices or for a specific device, as well as change its settings in the Web Console.

To manage quarantined files in Kaspersky Security Center, you need to enable the transfer of data about quarantined files to the Administration Server.

You cannot quarantine System Critical Objects (SCO). SCOs include files that are necessary for the operation of the operating system and the Kaspersky Endpoint Security application.

The Quarantine file task is performed for files listed in the task properties on the Application settings tab, in the Quarantine file table.

The table contains the following information about the files that need to be quarantined:

• Path – Path to the directory on the device where the file is located.
• Checksum type – File checksum verification type.

Using the buttons above the table, you can add or delete information about the files you want to quarantine.

To add information about the file you want to quarantine, you need to click the Add button and specify the task settings in the window that opens.

Quarantine file task settings

Setting	Description
Specify the file you want to quarantine	In the drop-down list, you can select how to specify the path to the file to be quarantined: Specify file by full path Specify file by directory path and checksum
Full path to file	Field for entering the full path to the file to be quarantined. This field is displayed if in the Specify the file you want to quarantine drop-down list, you selected Specify file by full path. If the file is located on a network drive, enter the path to the file starting with the // characters. For example, you can enter //server_ip/shared_folder.
Checksum type	In the drop-down list, you can select the checksum type of the file to be quarantined: MD5. SHA256. This drop-down list is displayed if in the Specify the file you want to quarantine drop-down list, you selected Specify file by directory path and checksum.
File checksum	Field for entering the checksum of the file to be quarantined. This field is displayed if in the Specify the file you want to quarantine drop-down list, you selected Specify file by directory path and checksum.
File path	Field for entering the path to the directory of the file to be quarantined. This field is displayed if in the Specify the file you want to quarantine drop-down list, you selected Specify file by directory path and checksum. If the file is located on a network drive, enter the path to the file starting with the // characters. For example, you can enter //server_ip/shared_folder.

If you are trying to quarantine a file that is too big, the Quarantine file task may finish with the Insufficient space in Quarantine error. In this case, you can clear the quarantine or increase the quarantine size and then try again.

You can view the result of the Start process task in the task properties in the Web Console under Results.

Page top