Disable SentinelOne to Permit VSSADMIN and DISKSHADOW

article #1438, updated 11 days ago

SentinelOne (S1) considers deletion of volume shadows to be bad actor behavior, because it often is a way that cryptolockers delete last-known-good checkpoints. Unfortunately, there is a lot of cleanup which ends up being required as the hidden NTFS System Volume Information folders on Windows machines build up and up and up in size. I’ve seen 20G, 50G, 178G, 158G so far, at least nine of them since I’ve been looking the last few weeks, and every time this occurs, the overall system slows down, and often slows down a whole lot. WizTree is my favorite method of identifying this situation, but there are many.

In order to deal with the huge SVI folder with S1 installed, one must do this:

  1. First get the Passphrase for the machine, from the S1 console. It’s under Actions, you can choose Show Passphrase. Do be aware that your S1 admin will probably receive a notice that you have asked for this.
  2. cd "C:\Program Files\SentinelOne\Sentinel*"
  3. Please put the actual passphrase in, and the quotes are necessary:
    .\sentinelctl.exe unload -slam -k "<passphrase>"
  4. vssadmin delete shadows /all
  5. Only if this is a server, check System Volume Information size again. If it’s still big, do these two:

    diskshadow
    (within diskshadow’s command line:) delete shadows all

    This can take a while, especially if SVI is big, e.g., more than 20-30 gigabytes. It can get huge occasionally, more than one hundred gigabytes. I recently saw 1,022 shadow copies deleted (it tells you the count at the end) from one server.
  1. .\sentinelctl.exe load -slam

And you are done.

If you should need to reenable S1 after work such as the above, here’s a paste:

cd "C:\Program Files\SentinelOne\Sentinel*"
.\sentinelctl.exe load -slam

Categories: