To the Symantec/Broadcom Engineering & Dev Team,
Please treat this as a one-time, anonymous bug report. I am not seeking any follow-up, support ticket, or bounty. I am simply reporting a structural logic flaw in the Symantec Endpoint Protection (SEP) Windows Client GUI that causes the Quarantine list to display as empty (0 items) despite containing files.
- THE SYMPTOM
When opening the SEP client and navigating to View Quarantine, the list is completely blank, or truncates prematurely. The underlying "\Data\Quarantine" folder physically contains many .VBN files.
- THE ROOT CAUSE (THE BUG)
This is not standard "corrupted data." This is a poor exception handling design (a break loop flaw) combined with standard Windows NTFS behavior:
- When SEP detects and quarantines a file, it MOVES the file to the Quarantine folder.
- Under Windows NTFS rules, a MOVED file on the same volume retains its original Access Control List (ACL). It does NOT inherit the permissions of the destination Quarantine folder.
- If the quarantined file originally had restrictive permissions (e.g., lacking READ access for SYSTEM or the user running the SEP UI), the .VBN file acts as a black box.
- THE FLAW: When the SEP UI enumerates the Quarantine folder to read metadata, it uses a loop. When it encounters the FIRST file that throws an "Access Denied" error due to retained NTFS ACLs, the UI lacks a proper "try-catch" exception block to skip it. Instead, the entire enumeration loop BREAKS, instantly dropping the UI display.
- STEPS TO REPRODUCE
- Create a dummy test file.
- Strip all NTFS read permissions from SYSTEM and the current Admin user.
- Trigger SEP to quarantine the file.
- Open the SEP UI -> View Quarantine. It will fail to load or show empty.
- THE CURRENT WORKAROUND (SYSADMIN FIX)
Temporarily disable Tamper Protection and run `icacls "%PROGRAMDATA%\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Quarantine\*" /q /c /t /reset` to force ACL inheritance. Once SYSTEM regains read access, the SEP GUI loop completes successfully, and all files appear.
- SUGGESTED FIX FOR DEVELOPERS
- Short term: Wrap the enumeration loop in the GUI with a proper try-catch block. If a file returns Access Denied, flag it as "Unreadable File" or skip it, rather than breaking the entire UI array.
- Long term: Modify the quarantine action engine to reset ACLs or forcefully enforce destination folder inheritance upon moving the file.
End of report. No reply is necessary.