Error 768 with DLP EDPA and WDP service failures

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

The EDPA and WDP service fail to start or terminate, with the following error in the Windows Event Viewer.

Windows could not start the EDPA service on Local Computer. An exception occurred in a user mode callback and the kernel callback frame should be removed.

Environment

• DLP 15.x
• Windows 10 

Cause

• Corrupt Windows system files.
• The agent package being pointed to an incorrect server address.

Resolution

To verify whether there is corruption in the Windows system files, use the System File Checker tool to repair missing or corrupted system files.

1. Press the Windows button+R to open the “Run” box.
2. Type “cmd” into the box, and then press Ctrl+Shift+Enter to run the command as an administrator.
3. Click Yes when asked "Do you want to allow this app to make changes to your device?"
4. At the Command Prompt, type the following and press Enter.
   
   sfc /scannow


5. After the scan completes, review the details to see if there was system file corruption and whether or not Windows was able to fix it.
   
   
   
   
6. If the scan was unable to fix the corrupt files, back up all personal data first, and then reimage the system with DLP.