Uninstalling the DLP Agent removes msvcr120.dll, or other shared DLL, from System32 directory

Products

• Data Loss Prevention Core Package
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

When uninstalling the DLP agent you noticed that msvcr120.dll, or other shared DLL, is removed along with the agent from C:\System32. This may remove a dependency for another application deployed in your environment.

Cause

The DLP Agent MSI installer deploys multiple shared DLLs into C:\System32. As per the standard MSI design whenever an application deploys a shared DLL it will write a registry key which lists all the shared DLLs in the system. The key will also contain the count of applications using/dependent on the DLL. If the DLL was already present in the system prior to running the MSI installer the registry key will be incremented by 1. This is an indicator of how many application use or deploy the given DLL.

The registry key is Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

When software is uninstalled, in this situation the DLP Agent, the MSI will query the same registry key to verify if there's any other application using the DLL - the registry key should be higher than 1 in such scenario. If the registry value associated with the DLL is set to 1, then MSI will assume that the only software dependent on the DLL is the one currently being uninstalled. As a consequence, with the value at 1, the MSI will uninstall the DLL. Otherwise if the registry key value is higher than 1 the DLL will not be removed. Instead the registry key will reduced by 1. 

This is normal behavior of MSI installer. In a situation when any other software dependent on the DLL does not increment the registry key when installed the DLL will be uninstalled.

 

The below screenshot shows an example where msvcr120.dll would not be removed as the value associated with the DLL is 19. The MSI uninstaller would only decrease the number down to 18. However msvcr100.dll would be removed as it's value is set to only 1. Please note that msvcr100.dll will not be removed by the DLP Agent as it does not deploy or utilize it - it is only mentioned as an example of a DLL that would get removed should an appropriate uninstaller be executed.

Resolution

There are 2 alternatives to resolve, or mitigate, the issue.

1. As a workaround the DLL value can be incremented by 1 manually. This way when the DLP Agent is uninstalled the MSI will only decrease the value by 1, moving it back to the original value and leaving the MSI in the C:\System32 directory.

2. Ideally if any other software is dependent on the DLL it should increase the registry key value by 1. If it's not doing it then the vendor of the software should be consulted to either change the behavior of the installer, or to implement an additional step to the software deployment so that this step is not missed.