File Scanning Action is set to “Ask after scan” but Elements Agent still quarantines a file

Issue:

We have in our Elements profile for Elements Endpoint Protection for Server / Computers set the File scanning action as "Ask after scan", but files are still quarantined automatically when they scanned. Why are files still quarantined?

Resolution:

There are many reasons why the files could still get quarantined. First we recommend to go to the Security Events page in the Elements Security Center portal to check the detection for the quarantine event. From the detection you can check if the file in question was a malware, riskware or spyware. 

If the file has been detected as either riskware or spyware, they have separate actions available on the real-time scanning settings page in the profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Real-time scanning settings page
5. Scroll down to the File scanning section
6. Check the following actions that they are set as Ask after scan:
   1. Action on riskware
   2. Action on spyware
7. Click Save profile

Scheduled scans are considered manual scans, so if the file was quarantined during a scheduled or manual scan, you need to check the Manual scanning settings for the Action on infection. 

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Manual scanning settings page
5. Scroll down to the Manual scanning section
6. Make sure that the Action on infection is set as Ask after scan
7. Click Save profile

We also recommend to check in the profile on the End user rights page that all the settings are locked. If settings are left unlocked, a local user could have changed the settings locally.