AV Endpoint Log Error: Spanned Volume Boot Sector

Version 1

    Details

    Lumension Endpoint Management and Security Suite (LEMSS) 7.x
    LEMSS 8.0, 8.1
    Lumension AntiVirus
    Endpoints with spanned disc volumes

    Following an AntiVirus scan on an endpoint that contains one or more spanned volumes, an error for each disc in the span set is listed in the endpoint logs (C:\ProgramData\HEATsoftware\LMAgent\logs\eps.log for 7.x, C:\ProgramData\HEATsoftware\LEMSSAgent\logs\lmhost-main.log for 8.x):


    year-month-date-time,0x4D74490,VirusScanner,critical,"LM.EPS.VirusScanner: CWinBootSectorMgr::GetDeviceNumber - IOCTL_STORAGE_GET_DEVICE_NUMBER failed. hr=-2147024895"

    year-month-date-time,0x4D74490,VirusScanner,critical,"LM.EPS.VirusScanner: CWinBootSectorMgr::EnumVolumes -
    GetDeviceNumber returned error for drive: D:\"


    Note: The drive letter will vary for your endpoint.


    This error occurs because AntiVirus is cycling through each endpoint drive, trying to determine the endpoint boot sector that it needs to scan. AntiVirus only scans the boot sector for the endpoint's boot drive (usually C:\). However, AntiVirus does not scan the boot sectors for spanned volumes (or any other non-boot drive). Therefore, this error can be safely ignored.