Failures in detection when uploading files from a virtual drive or document centralization system using a web browser

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

The DLP Endpoint Agent logs show the following error:

`MessageListener::HandleFileClose(): FilterGetDosName() failed for device type: 14 | [SYMRESUL 0x8007007b]`

This error indicates that the filesystem handler cannot resolve the DOS path for the virtualized storage.

Environment

*   Symantec Data Loss Prevention (DLP) Endpoint Agent 16.x and later

*   Windows Endpoints

*   Virtual drives or storage solutions

Cause

The agent architecture uses a driver-based approach for monitoring file operations. This driver relies on file-close notifications to obtain the file path. In specific environments, such as virtual drives, the driver fails to resolve the DOS path or does not receive the notification, causing the detection event to be missed

Resolution

The SDK-based monitoring bypasses the driver intervention for browser monitoring. Follow these steps to implement the solution:

Enable Content Analysis Connectors: Configure your endpoint policy to use the browser extension (SDK) for Chrome or Microsoft Edge instead of the default driver-based monitoring.

 For detailed implementation steps, refer to the Broadcom technical documentation on Monitoring Browsers Using Content Analysis Connectors on Windows Endpoints.

By using this approach, the agent retrieves the file path directly from the browser extension, addressing the root cause of the filesystem handler failures.

 

If you require further assistance, see Contact Support."