Symantec DLP Detection Server Service not starting and disabled after upgrading do DLP 16.1

Products

• Data Loss Prevention
• Data Loss Prevention Core Package
• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Discover
• Data Loss Prevention Network Monitor and Prevent for Email
• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention Network Monitor and Prevent for Web
• Data Loss Prevention Network Prevent for Email

Issue/Introduction

After upgrading a detection server in your environment to 16.1 (or higher) you noticed that the Symantec DLP Detection Server Service (SymantecDLPDetectionServerService) is not running and that it's disabled. The same might raise alerts in 3rd party monitoring software configured to watch the status of the service/s in the DLP environment.

Environment

16.1 or higher

Cause

In DLP 16.1, or higher, the detection servers utilize two new services:

1. Symantec DLP Detector Server Service (SymantecDLPDetectorService)
2. Symantec DLP Enforce Connector Service (SymantecDLPEnforceConnectorService)

The service used prior to DLP 16.1 - Symantec DLP Detection Server Service - will be disabled during the upgrade.

Resolution

No action is necessary in the DLP system. The Symantec DLP Detection Server Service is expected to be disabled and not running in DLP 16.1 or higher. 

If the service status alert was raised by 3rd party monitoring tools it will need to be adjusted to watch the new services instead - Symantec DLP Detector Server Service and Symantec DLP Enforce Connector Service

Additional Information

For additional information on the DLP services refer to the official documentation:

Symantec Data Loss Prevention Services