Detection server service will not start - Error: file not found

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Enforce

Issue/Introduction

The detection server is showing status "unknown" on Enforce Console. Logged into server and found service is not started. Unable to start service with error: "Error 2: The system cannot find the file specified"

Environment

Release : 15.7 and 15.8

Component : DLP services

Cause

Incorrect data in paths to start services

Resolution

Most common issues:
1. Check the affected service configuration file. SymantecDLPDetectionServer.conf on Detection Server in this case if it is pointing to the correct JRE.
Java Application
wrapper.java.command = C:/Program Files/Symantec/DataLossPrevention/ServerJRE/1.8.0_202/bin/java
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Data Loss Prevention in regedit and make sure the values for Enforce, Detection server, JRE, and Service User are correct
3. Check each DLP service in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\, the ImagePath values were all in double quotes.Example:
"C:\Program Files\Symantec\DataLossPrevention\Detectionserver\Services\SymantecDLPDetectionServer.exe -s SymantecDLPDetectionServer.conf"
It should be
"C:\Program Files\Symantec\DataLossPrevention\Detectionserver\Services\SymantecDLPDetectionServer.exe" -s SymantecDLPDetectionServer.conf
Note only the path to the exe should be in double quotes. the -s option should not be included in the double quotes.

Additional Information

For DLP 15.8, the ImagePath value "C:\Program Files\Symantec\DataLossPrevention\Detectionserver\Services\SymantecDLPDetectionServer.exe -s SymantecDLPDetectionServer.conf"  is located in the registry key below:

\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SymantecDLPDetectionServerService

For the SymantecDLPDetectionServer.conf, look at this location on DLP 15.8:

C:\Program Files\Symantec\DataLossPrevention\DetectionServer\15.8.00000\Protect\config\factoryDefaultTemplates