none
Azure Information Protection Scanner scanning inconsistencies RRS feed

  • Question

  • We deployed an AIP scanner to scan a bulk of our network shares to identify sensitive information if it exists for protection.

    There is approximately 70 shares with a total of about 1 TB of data to be scanned.  Reports are set to debug for full details 

    Because of the current network configuration that is being upgraded at the end of the month I am only adding about 200 GB / night and conducting manual scans in debug mode, continuous scans will be enabled when the network is upgraded. 

    In my first attempt after day 2 of adding a few repositories totaling 100 GB / day at most the scanner ran into memory issues (it had 8 GB and 4 processors). 

    We added more ram that day (for a new total of 40 GB) to alleviate the errors, it did, no more memory errors.  

    I then added another few repositories thinking the scanner would re-scan the directories it had memory issues with, it did not.

    My next step was to do a reset scan Start-AIPScan -Reset and I removed all previous reports thinking a fresh start would re-scan every repository added up to this point (roughly 300 GB)  However, I noticed going through the report the directory the scanner had previous issues with scanned the files in that directory but not any of the sub directories nor do they show up on the report they were skipped  

    I added a couple more repositories and performed another manual scan -  those previous directories that the scanner had memory issues with are not being scanned 

    This is not a character limitation  143 total limit is 260 on windows 2016, nor a permissions issue

    Another observation is the summary txt file shows the total # of scanned files increasing, however, the csv with the detailed report contains less files than the previous night's and is a mixture of previously scanned plus new.

    I need to depend on the results of these scans, the current inconsistencies are concerning.   Any thoughts?



     
    Wednesday, April 17, 2019 5:04 PM

All replies