Data Loss Prevention

 View Only
  • 1.  Endpoint agent blocks SecureCRT application

    Posted Sep 20, 2016 10:18 PM

    I have installed Endpoint agent 14.5 on Window10/64bit machine and server is also v14.5. After the installation of DLP agent SecureCRT v8 application does not open. It throws an error "Failed to initialize application: Cannot find window class"

    However, when I open the application with "Run as Administrator" option, it works.

    Application works fine without DLP agent. What should be causing it? Where to begin with troubleshooting?

     

    SecureCRT is a terminal emulator, used for secure remote access, file transfer, and data tunneling.



  • 2.  RE: Endpoint agent blocks SecureCRT application
    Best Answer

    Posted Sep 21, 2016 04:18 AM

    Hello,

    Are you monitoring SecureCRT with the Application File Access (Application Monitoring)? If yes, probably the software is accessing several paths in your local disk and for that reason it becomes slow / unresponsive since DLP needs to check it all. To avoid that you can reconfigure the software monitoring in the Application Monitoring  or if it doesn’t work you might need to use the Process Monitor (or similar tool) to check which kind of actions the software does and then create some exceptions in the Agent Config / Agent Monitoring / Add filters to ignore paths or files (bottom of page).

    Alternatively, you can try to disable some monitoring channels (i.e. Removable Storage) to see if it solves the problem. I’ve seen software that only works good if some channels are not being monitored.

    BR,



  • 3.  RE: Endpoint agent blocks SecureCRT application

    Posted Sep 21, 2016 04:27 AM

    Yes, I'm monitoring SecureCRT via Application File Access. I've unchecked all the activities to monitor for the SecureCRT.exe in Application Monitoring Configuration and that seemed to have resolved the issue for now. I will enable each one at a time to find the root cause.

    This was helpful. Thanks.