Can DLP tamper protection protect the edpa from getting stopped
search cancel

Can DLP tamper protection protect the edpa from getting stopped

book

Article ID: 256069

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Data Loss Prevention Core Package Data Loss Prevention Endpoint Suite

Issue/Introduction

An Administrator with unrestricted access has stopped the edpa service without the service_shutdown tool. Can DLP tamper protection protect the EDPA service from getting stopped in such scenarios? 

Resolution

DLP has innate tamper proofing on the service itself via the watchdog process 
Tamper protection significantly increases the overall security of the agent, but is not a 100% foolproof solution.

If an agent stops reporting, it shows up in the Agent dashboard in Enforce UI. Non-reporting agents should be investigated individually.