brkrprcs64 does not start on the endpoint

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

The issue is related to the situation when You have DLP Browser Extension deployed in the Chrome/Edge browser but brkrprcs64 does not start.

Remember that brkrprcs64 should be running only when the browser with DLP extension is running.

Environment

DLP 15.8 and higher

Windows

Cause

Environment hardening is most probably causing this issue.

When the user opens Chrom/Edge the browser is loading the extensions. When the DLP extension is loaded it calls C:\Windows\system32\cmd.exe on behalf of chrome.exe(in exmaple) with Command line: C:\Windows\system32\cmd.exe /d /c "C:\Program Files\Manufacturer\Endpoint Agent\brkrprcs64.exe" chrome-extension://dehobbhellcfbmcaeppgfjhnldeimdph/ --parent-window=0 < \\.\pipe\chrome.nativeMessaging.in.44ad7861ed83243d > \\.\pipe\chrome.nativeMessaging.out.44ad7861ed83243d and then cmd.exe is calling the brkrprcs64.exe.

Very often during environment, hardening implementations customers block CMD.exe via GPO or with help of 3rd party security software.

Resolution

To resolve this issue CMD.exe should be allowed to run on the endpoint.