Data Loss Prevention

Hi,

When copy of confidential documents to local drive or network share user did not receive pop-up notification but incidents was created in the Endpoint incident list.

However when printing confidential document user receives popup notification and incident created. 

DLP ver 11.0

Confidential Documents Policy Active with "Notify End User" response rule

Agent Cofiguration - Destinations to Monitor - (selected) Local drive, Network share, Printer/Fax

The user didn't get the popup for the copy...but was he allowed to make the copy at all? What does Enforce say about the final action after the popup was supposedly generated? Did it say "Action allowed" or "Action blocked"?

Try copying to a USB disk and share if you get an incident/popup.

Verify that you have these protocols turned on within your Agent Configuration.

System Overview --> [Your Endpoint Server] --> Configuration --> Agent Configuration tab.

The File Share is a new 11 feature, and probably not on by default (or turned on after an upgrade).  Local Drive is not all that commonly used, and not turned on by default. 

I would suspect that if you're not getting incidents for these protocols, that it's because you are not monitoring them.

If they are on, you need to verify that your agent (the one your testing) has the latest configuration...i've had cases where the agent isn't getting the config due to a communication issue, and it's messed me up in testing until I realized that the agent was on an older configuration.

Good luck!

~Keith

Hi xlloyd,

User didn't get the popup and the copy was allowed no message display at all..

The agent was installed on a virtual win xp machine. is VM supported? 

Hi Jack,

Have you tested what kreynolds said above? Is the agent's config file updated?