Workstation hangs or crashes after installing DLP Endpoint Agent

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

Workstation hangs, crashes, or bluescreens after installing DLP Endpoint agent. 

Environment

Windows environments. 

Cause

The Windows User Access Control (UAC) level was elevated, but the CUI.exe and CUIL.exe were not included to receive the elevated privileges. When the DLP edpa.exe service tried to launch CUI.exe or CUIL.exe, they're blocked by UAC. DLP is stuck in a loop constantly trying to restart the services.

Resolution

There are two solutions to this issue. Elevate the privileges for both CUI.exe and CUIL.exe so they're able to run without additional UAC permissions or make it so all applications run as the invoker.

Solution 1: Elevate The Privileges of the Binary:

1. Open Explorer and navigate to the location where CUI.exe and CUIL.exe are stored on your computer.
   Right-click on CUI.exe to start with.
2. From the right-click menu, select Properties.
3. Go to the Compatibility tab in the Properties window.
4. Check the box that says Run this program as an administrator. This will ensure that the binary runs with elevated privileges every time it's executed.
5. Click Apply and then OK to save the changes.
6. Now, repeat steps 2-5 for CUIL.exe.

 

Solution 2: Configure System So All Applications Run As the Invoker.

This will add an environmental Variable to force all applications to run with the privileges of its invoker, essentially bypassing the UAC (User Account Control) prompt.

Open the System Properties:

1. Press Windows + R to open the Run dialog box.
   Type sysdm.cpl and press Enter. This opens the System Properties window.
2. Click on the Advanced tab in the System Properties window.
   Click on the Environment Variables button located near the bottom right of the window.
3. System Variables Section: In the lower half of the Environment Variables window, which displays system variables, click on the New button.
   Add the New System Variable:
4. In the Variable name field, enter: _COMPAT_LAYER
   In the Variable value field, enter: RunAsInvoker
   Click OK.
   Close & Apply:
5. Click OK on the Environment Variables window to close it.
   Click another OK on the System Properties window to apply the changes and close it.
   Restart the Computer (Optional but Recommended):