Long document opening times seen on endpoint devices with DLP

Products

• Data Loss Prevention
• Data Loss Prevention Enforce
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You see some long document opening times, in excess of several minutes, on endpoint machines that just got DLP installed.

The Procmon log has some entries that indicate AppSense is being constantly invoked while Word is being opened.

C:\Program Files\AppSense
C:\Program Files\AppSense\Environment Manager
C:\Program Files\Microsoft Officeoot\vfs\ProgramFilesX64\AppSense
C:\Program Files\AppSense\Environment Manager\Agent\EmLoader.dll
C:\Program Files\Microsoft Officeoot\vfs\ProgramFilesX64\AppSense\Environment Manager\Agent\EmLoader.dll

Cause

AppSense Environment Manager or Ivanti Environment Manager, owned by Landesk, is a desktop management software used for personalizing desktop experiences.

With both AppSense and the DLP agent running, the endpoint suffers slowness when opening files.

Resolution

Exclude AppSense from DLP monitoring.

• In Application Monitoring exclude the following executables:
  EmUser.exe
  AMAgent.exe
  
  See KB 160078: How to whitelist or exclude an application from DLP Endpoint agents
  
  
• In the agent configuration, add the following paths to an "Ignore" filter on the Channel Filters tab:
  C:\Program Files\AppSense\*
  C:\Program Files\Microsoft Officeoot\vfs\ProgramFilesX64\AppSense\*
  C:\appsensevirtual\*
  
  Add the "Ignore" filter for the "Local Drive" channel to the filter list before the first "Monitor" filter.
  See KB 225759: How to set a folder destination exclusion for Endpoint

Additional Information

Additional references:

About global application monitoring

Application Monitoring settings

Filter by File Properties settings