An Administrator with unrestricted access has stopped the edpa service without the service_shutdown tool. Can DLP tamper protection protect the EDPA service from getting stopped in such scenarios?
DLP has innate tamper proofing on the service itself via the watchdog process
Tamper protection significantly increases the overall security of the agent, but is not a 100% foolproof solution.
If an agent stops reporting, it shows up in the Agent dashboard in Enforce UI. Non-reporting agents should be investigated individually.