Microsoft Office documents take a long time to close the document when MIP detection is enabled

Products

• Data Loss Prevention Core Package

Issue/Introduction

Microsoft Office documents take a long time to close a document when MIP detection is enabled in the agent configuration. This may manifest in a short delay or a long delay and in some cases the Office program (Word, Excel, etc) can crash when trying to save and close an Office document.

Cause

This was found to be caused by problematic policies in the environment. By design when DLP is using MIP detection with Office it will trigger a scan of the meta data before the file is saved and then again as the file is saved. Twice in total.

When running detection on another channel, such as HTTPs, it would be expected that the detection of the same data would take about half as long as Office takes to save the document.

 

Resolution

If these detections are taking too long then it recommended that the policies be tuned (see this KB to find the offending policies) or disable the MIP channel.

Note that due to the nature of the meta data it is not possible to add exceptions for the size of data in the policy or agent configuration (similar to file size exceptions)