Showing results for 
Search instead for 
Did you mean: 
Level 10

Troubleshooting DLP with the Registry

Troubleshooting DLP can be a bit tricky on some boxes, so you can pick up some vital info out of the registry..

So the SD card works on my computer and the following values are present:


REACTION      17 Monitor/NOTIFY?

RuleType     1

USB Also Works:

Its Serial Number is USB\VID_0930&PID_653D\0E907560F301F924


REACTION           17          MONITOR/NOTIFY?

RuleType           1




RuleType 1

For BlueTooth...which should be blocked


RuleType 1

AND Wireless Cards


REACTION 1          - BLOCK?

RuleType 3          - so I think RuleType 3 is for Plug and Play Devices

Also, you should be able to get a list of USB Serial Number Exemptions out of here if you make exemptions that takes a little decoding, but a bit quicker than running the DLPE Diagnostic tool.

Sometimes you just dont know if you are fighting a GPO, driver issue, bad media...etc

0 Kudos
1 Reply
Level 10

Re: Troubleshooting DLP with the Registry

A little additonal troubleshooting info:

Also, you need to check CSmiley TonguerogramDataMcAfeeCommon Framework\AgentEvents to see if DLP is generating .xml files there.

These can be opened with the DLPE Diagnostic Tool from Mcafee...I had to get this from a friend so I am guessing McAfee Support provides it.

Running this will give you a pretty good idea of what is happening.

When you run a "Collect and Send Props", all .xml files should disappear from this folder.

If you are seeing things being blocked, but no events showing up in the DLP Monitor,  go to the CSmiley TonguerogramDataMcAfeeCommon Framework and open the EvtFiltr.ini to see if 19015 events are being blocked.  If they are, you need to go into Server Configuration in the EPO console to re-enable these.

ADDITIONAL NOTE:  If programs like Roxio or IMGBurn are acting weird with DLP, try deleting the Upper Limits Filter value out of the registry, this can fix some of these issues.

0 Kudos