Antivirus TimeOut can cause all versions of documents to be deleted

Summary

When files are uploaded to SharePoint using Windows Explorer, explorer sends a request to delete the document from the server if it encounters an issue during a copy or if there is an error in uploading a file. This is to avoid leaving behind broken copies of a file on the server. Windows Explorer does not talk directly to SharePoint, but asks the Win32 process to delete the file. Thus, Windows Explorer is not aware that it is communicating to SharePoint, or any specific DAV server. This behavior is reflected to the server as a file delete – and thus when an antivirus scanner times out while scanning a file, SharePoint will inform Windows Explorer that an error occurred while uploading the file, and Windows Explorer replies asking the file to be deleted.

Please note that this issue does not reproduce with upload from a web browser.

Are there any workarounds?

The issue can appear when the antivirus scan timeout is too small. We recommend not to change the default value of the antivirus timeout configured on SharePoint. SharePoint and our antivirus scanning partners suggest that you keep this value high enough to withstand any outliers, approximately 10 minutes or 600 seconds. This configuration can avoid this issue altogether.

More Information

We highly recommend using the workaround proposed to avoid this issue and to work with the support team to handle any other problems that may arise from this particular issue.
Properties

Article ID: 2741367 - Last Review: 14 Aug 2012 - Revision: 1

Feedback