Understanding what Licenses a DLP Endpoint is receiving
search cancel

Understanding what Licenses a DLP Endpoint is receiving

book

Article ID: 164225

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

At times, an Endpoint Agent will behave in a way contradictory to expectation.  Larger than simply missing a single policy, the Endpoint Agent will seemingly completely ignore all Prevention or Monitoring channels.

Cause

Missing Prevention or Monitoring on an Endpoint across all channels may be a sign of a bad or missing license.  To see what licenses the Endpoint is approved for, review the EDPA logs for the following:

01/10/2017 14:52:37 | 14216 | INFO    | AgentServices.License | License update received: Discover: Yes, Monitor: No, Prevent: No, Agent Management: Yes

In this example, both Endpoint Monitoring and Prevent are not approved by the currently loaded licenses on Enforce.  The Endpoint Agent will fail to function as expected if the adminstrator believes Monitoring and Prevent should be enabled.

This line is only ever printed in EDPA under two circumstances:

  1. On first start of EDPA after an install.
  2. If licenses are updated on Enforce.

Resolution

To update the Endpoint Agent licenses at the Endpoint:

  1. Add the Endpoint Prevent License to Enforce.
  2. Restart VontuManager and VontuMonitorController services on Enforce.
  3. Reboot the Endpoint to force the endpoint to check in to the Endpoint Server.

Additional Information

Please note DLP endpoint licenses are perpetual. This means that the license authorizes you to use the product indefinitely.