DLP endpoint agent upgrade causes a black screen on the computer

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Discover

Issue/Introduction

Symantec Data Loss Prevention (DLP) 
Endpoint Agent

When upgrading the Endpoint agent, the computer may hang at a black or blank screen after the upgrade completes.
A reboot of the computer returns it to normal operations and the agent version shows the upgrade did complete.

The Windows Application Event log has the following entry which indicates a permissions issue:

"Application 'C:\Windows\explorer.exe' (pid 15288) cannot be restarted - Application SID does not match Conductor SID.."

Environment

Windows 10 Pro 64-bit

Cause

Permissions issue.

Resolution

From "https://answers.microsoft.com/en-us/msoffice/forum/all/common-issue-after-office-upgradation-from-old/19fb0f26-09a5-45b3-890e-b6a0eb21938f".

 

The error "Application SID does not match Conductor SID" will be generated whenever the user account the service is being run under does not match the user account used to launch the setup instance. 

The term "Conductor" refers to the MSI setup engine. 

If the setup is executed with elevated permissions (Run As Administrator), then the SID check is bypassed. 
This behavior is by design and is intended to prevent the malicious restarting of critical system services.