Error: "Windows could not start the EDPA service on the local computer. Error 768"

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Enforce
• Data Loss Prevention Plus Suite

Issue/Introduction

The Data Loss Prevention (DLP) Endpoint Agent (EDPA) and Watchdog (WDP) services do not start after install. 

Starting services manually produces the following error:

Windows could not start EDPA service on Local Computer.  Error 768: An Exception occurred in a user callback and the kernel callback frame should be removed.

Symptoms may include 0 byte ks.ead and sto.ead files.

Environment

DLP 15.X, 16.x

Cause

The agent install is corrupt. This could be caused by a bad/corrupt installation package or install process or other programs / tools modifying the DLP agent install.
Also this could be from an improper account used for installation, such as a non-Admin account, lacking necessary permissions.

The issue may also be caused by an incorrect agent install version or architecture. See EDPA or WDP service not starting or has stopped on the DLP agent.

Resolution

The first thing to try is to recreate the agent package and uninstall / reinstall the agent

1. Create a new agent install package.
2. Install using the install_agent.bat file when logged in as the local administrator.

If the install works and the agent runs for some time then stops working again then another program is likely corrupting the DLP agent files. First Review your AV settings and make sure the proper exceptions are in place for the DLP agent.

Another possible cause is if the clean_agent utility is being partially / improperly run on the client. This can happen when automatic software distribution scripts to update the DLP agent run on the machine using the wrong version of clean_agent and / or other tools.