Error 768: An exception occurred in a user mode callback and the kernel callback frame should be removed." and the EDPA service does not start.

Products

• Data Loss Prevention

Issue/Introduction

In some Symantec Data Loss Prevention environments, after installation of DLP 15.8.x Agent, EDPA service does not start up. When you try to start it, you will get: Error 768: An Exception occurred in a user callback and the kernel callback frame should be removed.

Environment

Data Loss Prevention 15.8

Cause

Some software depends on the zlib library, and placing the zlib1.dll in the C:\Windows\System32 folder, affects the startup of agent services. 

Resolution

Verify the presence of zlib1.dll in C:\Windows\System32 folder first. If present, confirm which application needs it and make sure that the dependent application already has it in its own directory.

As an example, a quick search in the registry might show this:

C:\Program Files\AccessData\Agent\zlib1.dll

C:\Program Files\CA\Identity Manager\Credential Provider\System32\zlib1.dll

C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll

In case, any application which needs that dll file does not have it in its own directory, move it in there and then rename or delete the one in C:\Windows\System32 folder.

After renaming or deleting the zlib1.dll in C:\Windows\System32 folder, start the EDPA service again.

 

Additional Information

Other conditions can cause the Error 768. See the alternate resolution:

https://knowledge.broadcom.com/external/article/170044/error-windows-could-not-start-the-edpa-s.html

https://knowledge.broadcom.com/external/article?articleId=184637