Data Loss Prevention

Working with a customer on DLP on the Endpoint and this morning they have a larger than normal amount of endpoints that are not connecting and reporting to the DLP Endpoint SErver.  In looking at the DLP Console they all show "Service Stopped By Admin Tool" and the time shows to when they turned off the laptops and went home.

 

This morning they are back to work, laptops are back on, connected to the network and happily working away.  Except for the DLP Endpoint agent.  These still all show "Service Stopped By Admin Tool" in the console and are not generating alerts.  I can't perform any troubleshooting from the console, so just curious what the next steps are.

 

Thanks in advance

Does anyone besides you have access to the shutdown.exe tool?  This error is tied to that tool specifically on the kb site.  Hope that this is not the case and you don't have a rogue security person out there shutting down agents on you.  

So, it seems that the DLP agent doesn't start up correctly. Usually, such kind of issue may relate to confliction between DLP and other service. Suggest to collect the debug log of the agent to find out the root cause.

No one that I am aware of has access to the shutdown tool.  And if they did they would have to have the password for that as well correct?

We uninstalled the DLP agent on this machine as well and it still hasn't started reporting as well :(