After uninstalling the DLP Agent, a single file ffm.dll is still present on the endpoint
search cancel

After uninstalling the DLP Agent, a single file ffm.dll is still present on the endpoint

book

Article ID: 164637

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

After uninstalling the DLP Agent from an endpoint, there's still a single library file named ffm.dll which is left behind. The file can be deleted manually via Windows Explorer, nevertheless it should have been removed by the uninstallation. 

Resolution

The reason why the file hasn't been removed is that there's still a Registry entry present for the file in the following Registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs

If that location contains an entry for the ffm.dll file with a Non-Zero entry, then the file will not be removed during the uninstallation of DLP Agent.

To fix this, remove the entry from the Registry manually and then perform the Agent uninstallation again.

To remove the entry, on the affected endpoint launch Regedit (make sure it's launched as Administrator) and go to the location specified above. Then look for an entry that contains the ffm.dll driver file (see example below):

Once you locate the entry, right-click on it and select Delete

The same process applies for any other DLP Agent files that might get left behind after an uninstallation.