cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
mtmy-zul
Level 9
Report Inappropriate Content
Message 1 of 6

Assign DLP policy to domain user

Jump to solution

Hi team,

I am using DLPE-onprem. Is it possible to assign DLP policy to domain user instead of system/pc? This is because some of the employee sharing the PC but they are using different policy.

1 Solution

Accepted Solutions
Dex
Level 8
Report Inappropriate Content
Message 3 of 6

Re: Assign DLP policy to domain user

Jump to solution

Hello @mtmy-zul 

Yes, it is possible to assign policies to domain users. I will try to explain in a general way:

First, you must have a registered LDAP server.

If you already have an active LDAP sync, create an end user group (DLP Policy Manager -> Definitions).

Within the new group, set the "Identify LDAP objects by SID (Security ID)" option and add users, groups, or OUs as needed.

After that, create a new rule set and a new rule, and in Condition -> End User: select "Belongs to one of the end user groups (OR)", click the three dots button and check your group and confirm all changes.

As a personal recommendation, create a new policy for testing purposes, assign the new rule set, and deploy the test policy to one system before deploying it to all systems.

When using rules by user group, consider this scenario: If two or more users are logged in, the least privileged user takes precedence.

View solution in original post

5 Replies
Fotunba
Level 8
Report Inappropriate Content
Message 2 of 6

Re: Assign DLP policy to domain user

Jump to solution

Hi,

 

I don't think it's possible (well so far). If you have hot desking /shared systems policy, create an exception group in your End-User group menu option, add users to exempts, in your rules, enable rule exceptions and add the group. They should be able to bypass the policy

Dex
Level 8
Report Inappropriate Content
Message 3 of 6

Re: Assign DLP policy to domain user

Jump to solution

Hello @mtmy-zul 

Yes, it is possible to assign policies to domain users. I will try to explain in a general way:

First, you must have a registered LDAP server.

If you already have an active LDAP sync, create an end user group (DLP Policy Manager -> Definitions).

Within the new group, set the "Identify LDAP objects by SID (Security ID)" option and add users, groups, or OUs as needed.

After that, create a new rule set and a new rule, and in Condition -> End User: select "Belongs to one of the end user groups (OR)", click the three dots button and check your group and confirm all changes.

As a personal recommendation, create a new policy for testing purposes, assign the new rule set, and deploy the test policy to one system before deploying it to all systems.

When using rules by user group, consider this scenario: If two or more users are logged in, the least privileged user takes precedence.

Fotunba
Level 8
Report Inappropriate Content
Message 4 of 6

Re: Assign DLP policy to domain user

Jump to solution

@Dex thanks for this, but maybe I'm missing something. This new policy you've created still applies to the system and not directly to the user. The rule is applied to the user/user group and not the policy? This is still same as creating an exception on existing rule and add group with users to exempt. saves effort, time and managing multiple rules/policies

Dex
Level 8
Report Inappropriate Content
Message 5 of 6

Re: Assign DLP policy to domain user

Jump to solution

Hi @Fotunba.

You must apply the policy with rule sets (and rules) created for end-user groups in a general way, assigning the policy to the entire system tree or to the groups that you have defined.

In our environment, we have a general policy applied to all computers, and we create specific rules for groups of users. This allows the user to keep their permissions even if they use any other computer.

Fotunba
Level 8
Report Inappropriate Content
Message 6 of 6

Re: Assign DLP policy to domain user

Jump to solution

That's absolutely fantastic! 👍 in our environment we use Exceptions with AD security group (USB Allow, Adobe Allow, Printing Allow etc.) 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community