Name: Office Hours | Forcepoint DLP Endpoint on Windows (NAM + EMEA)
Uploaded: 2026-04-02T16:17:18.198Z
Duration: 1 h 15 min 12 s
Description: Office Hours | Forcepoint DLP Endpoint on Windows (NAM + EMEA)

Transcript for "Office Hours | Forcepoint DLP Endpoint on Windows (NAM + EMEA)": Yes. I I had to take another big swig of coughing. Very cool. And we're kicking. I see the numbers are starting to tick up. Welcome, everyone, to our office hours event today. We'll give it a few minutes for folks to join before we kick off. Awesome. Awesome. Okay. The numbers are starting to steady, so we'll go ahead and kick it off. Just wanna again welcome everyone to today's office hour session on build, deploy, and maintain Forcepoint DLP endpoint on Windows. We have a great team here today and some great material to go through. So without further ado, I'll just keep clicking. Before we get started, on the right hand side of your screen, you should see a few little boxes, chat docs and Q and A. These are all resources for you. Please feel free under docs, this presentation is available for download, and any questions that you have throughout the event you conclude in the Q and A, and our team here, Roger and Tim, will answer to the best of their ability. And towards the end of this session, we will have a quick survey, just if you don't mind filling it out, letting us know how we did or if there's anything we can follow-up with you on. And then email with this recording of today's event will be provided within the next twenty four hours following the event. All right, so again, meet your presenters. We have Tim and Roger here. They're from our technical support team, and they'll be walking you through today's session. I'll kick it over to you guys. Thank you, Victoria. As she mentioned, my name is Tim Reegler. I'm a senior technical support engineer with the DLP team here at Forcepoint. Roger Phillips is also on my team. He'll be answering questions behind the scenes when you put them into the q and a or chat panels. So feel free to keep him busy as we move through the through the deck here. And if you wanna move us to slide five. Awesome. Alright. So just a brief overview of the of the endpoint product. It's called Forcepoint f one e, the Forcepoint one endpoint. It is a a unified agent. It covers our DLP product, our web security product that does a remote filtering and an endpoint context function as well, the ECA. We are going to be only covering Windows 64 bit endpoints today. We no longer support Windows 32 bit, having in a couple of years. And the Mac endpoint session will be in a couple of weeks. Keep your eye out for scheduling on that. We, for years, packaged the endpoint with the manager product. So if you downloaded our infrastructure and DLP installer, you would also get the endpoint. That's no longer the case. You do have to download it separately from our support site. They are backwards compatible, forwards compatible to some extent from 10.1 on. So if you try to install the most modern endpoint twenty six zero two, That would work with a ten dot one manager. And then once deployed, the endpoint kinda takes over. Its protection will start automatically after the first restart of that workstation, and then it'll apply whatever policies you have configured, in the manager. And we can move to six. Thank you. Just a couple of, prerequisites to cover. Once you've downloaded the package builder, we've got a nice link there in, the documentation for you to use. You'll want to, you know, verify that you've got the right version on the manager server. Wanna make sure that you have access to the server using the DLP service account and that the server that the the the workstations have specific set of resources. Right? So we do recommend, as a minimum, an I three with one and point eight gigahertz, eight gigs of RAM, and gig and a half of free disk space. As a security tool, we poke into a lot of other processes on a workstation, and most other security tools do the same thing. Sometimes those hooks can cause conflicts. As such, we recommend ensuring that the exclusions are in place for any antivirus solution you have in your environment prior to the installation of the endpoint. And then, you know, we need to make sure that we all have read write access and that the the destination is not going to be encrypted. Setting. Perfect. Alright. So once you've downloaded the package, you're gonna you're gonna have a ZIP file on your desktop or in your downloads folder. Extract that, and that will present a set of files. Right? Many of those files, the WebSense endpoint package builder and the EPA 64 file, those are gonna be moved into the install folder for DLP and the client folder within that root install. The ins the package build process is best run from that location because of some other files configurations that the the the builder is going to pick up to then add into the installer. So once you've got your files in the client folder and you've launched the WebSense endpoint package builder, dot exe, it's gonna run you through a wizard. We have, some components that you'll select, language. You will, need to add the IP address or the host name of the initial contact DLP server. That's where we're going to get our first set of policy and profile data. It's also going to be where our configuration file is retrieved from that tells us where all of our other endpoint servers are. So in a larger environment with 10 or 15 endpoint servers or more, we don't know about any of the rest of those until we have contacted the first server configured here in the installer. We also have an auto update feature for the on prem f one e that you'd utilizes, an IIS, server, to to provide, just whatever the next build is that you've created. And take advantage of that if you feel the need. Most of the time, though, enterprises are using, their own deployment tools to update the endpoint rather than that feature. You'll select, the different platforms. Again, this is only gonna be for the Windows 64 bit, but you'd also have a Mac available to you there. You'll be able to configure where your installation path is. The default is gonna be the c drive program files, web sense, web sense endpoint. You also have some browser configurations that you can select at that time. You can with the more modern endpoints, you can disable print detection or or otherwise configure browser extension stuff. Once you have got all of the wizard sorted out, save the package. It will, you know, point you to saving it maybe on the desktop. You can put it in a repository at that time should you so choose. And now you have our installer, which is gonna be called Forcepoint one endpoint x sixty four dot exe. We can move to the next slide. So we're gonna mentally take just a quick trip back to when we extracted our ZIP. And we got our endpoint package builder dot exe, and we got our our EPA 64 MSI. We moved those into the slash client folder of the DLP install. But with that ZIP, there was also a custom message files templates ZIP, and we're gonna extract that as well, grab the contents of that folder, and then move them to the appropriate location on on the manager server, install folder slash custom slash endpoint message files. And there's an existing set there, but we do update them regularly. And if for one reason or another, the endpoint does not find an expected message or finds a message with improper format, it may fault the message files load process. And so these do need to be updated every time you build a new endpoint to ensure that we don't run into a missing message ID later down the road. We will cover the customization of these messages just a little bit more later in the presentation, but there is a document linked here that will walk you through customizing all of our pop up messaging, confirmation prompts, the little the little blue boxes in the corner. We do recommend, as a best practice, not using technical language in these confirmation or custom message prompts. Try to include a help desk contact or some kind of reference number so that when an end user is presented with these messages, they have, you know, concrete next steps to perform on their end that also retain the security that you're trying to achieve because we don't want them to oh, it was blocked doing this. Let me just try that instead to work around what the organization is trying to do. So, you know, giving them a prompt in that message is a is a is a good idea. So let's go to we can go to nine, but then I think, Victoria, I think we can skip well, we'll do 10 briefly. We kind of already covered some of this. We have, of course, minimum requirements for the hardware. We have local administrator rights required. We do strongly recommend that you exclude all of the directories and our, you know, services, processes from your AV and EDR. Again, no encryption on the file path or the folders. You do need to re ensure that remote desktop services are enabled. So RDS is required for some of what we're doing with the endpoint. And so that does need to be either through GPO or registry. You need to make sure that that is working for any targeted workstations for the endpoint. And then there is a web security auto update feature that if you've got both the web security product and the DLP product, you're gonna wanna disable that in the web security module before deploying the DLP endpoint. I think it can be reenabled later. Covered most of that. I'm gonna come back to this top piece because it is a best practice recommendation. Once you've built once you've built your installer, find just a single workstation to do a manual install on to test it, and then find a couple more. Do a small deploy to a few machines, and then do your enterprise deployment, your rollout to the thousands and thousands. And that will help identify any roadblocks or constraints in your environment before, you know, getting the larger sample size where you might find more unknown unknowns than you really were ready for. With that, we can go to 11. Thank you, Victoria. This is, you know, our first set of moving the endpoint from having a finished installer to actually on the endpoint. You can do it, again, manually. I do recommend, again, manually for the first install. Your second method here, you can do GPO or other deployment tools to to to actually get it into the environment and installed. Most of the time, is gonna require at least one restart. That is something to keep in mind. We also have a Citrix or VDI installation procedure. There are a couple of nuances that make it different than just installing on physical hardware, and we do have a link to that document that documentation in the docs that are that are available for this for this presentation. Regardless of how you regardless of how you install it and my apologies, regardless of how you install it, the f one e is gonna need to be restarted after the install. Then there are there are hooks that need to be in place that can only be that can only be accomplished during the boot process. So, you know, if if if you've ever noticed after an initial install, it can do some things. It can't do everything until that restart has occurred, and so we do recommend building that into your, install workflow. And then once it's been installed, double check the system tray icon and the endpoint UI itself to make sure that it's connected, shows enabled, that it got all of its policy and profile information, and then check it on the other side of the house in the UI itself using endpoint status page in the DLP console. And that will tell you successfully installed. If you see it if you see it healthy in both places, that is what we're looking for. We can move to 12. Alright. So I briefly mentioned the hooks, but for browsers, we require extensions for Chrome and Firefox in order for the main enforcement method that the endpoint uses to intercept and analyze transactions through the browsers. We now have the m v three. Over the last year or two, we have been releasing m v three extensions for the major browsers. Those are recommended if for some reason you still have m v two, extensions in your environment, please move to, the m v three versions at your earliest convenience. We have some print detection that is now done from or through the browser extension. Some of that is gonna be configured during the installer build process. That is then further going to be enabled with the install and then the enablement of the extension. Firefox does give us the ability to use a kinda configuration file that you can build into the endpoint. One of the wizard one of the wizard panes for the builder allows you to load a custom preferences file for Firefox in into the installer, which the installer will then enforce when it when it runs. So if you have additional extensions for Firefox, you build them into this preferences file, and then you give the preferences file to f one e. And f one e will make sure that all of those get enforced into Firefox for you. There is no separate extension installer, but there are organizations that choose to manage the extensions through other deployment processes, GPO, etcetera. In that case, you guys would have to put in, like, a extension settings subkey that would prevent some things from loading, and then it would come if you need us if you need assistance with customized extension loading configurations, please open a case. We will give guidance as needed. But if if not, if you don't do if you don't do any custom extension configurations, the endpoint itself will perform all of the all of the enforcement and installation of those extensions for you. And so we can move to 13. This is just a little bit more on our extensions. We're we have just started offering a Windows compatible Outlook add in. So for years, we've required an Outlook add in on our Mac architecture because of Apple's security restrictions. We have adapted that add in for the Windows endpoint so that it it it is able to intercept and analyze within the new Outlook framework. Also, I believe it it assists with the new Teams enforcement as well. It does require, it does require deployment into Exchange. So you, would wanna follow our, Outlook add in documentations, that are linked in the, in the docs for this session. It is straightforward, but it does apply, kind of broadly. So, if you have additional questions or concerns on, getting that into your environment, feel free to, ask some questions here in the chat or, open a case. Right? I think these are required. I think we can move to 14. Let's start talking about agent help. So, you know, we've now deployed the agent onto a workstation. The first thing we really wanna do is just make sure that on the workstation itself, everything installed properly and that it's running. So open up the system tray icon in the bottom right, find the little green force point icon, right click on that, and, then select, you know, open DLP endpoint. This is actually a really great first indicator of the health and the successful install of the endpoint. If you don't see open DLP endpoint in that list and perhaps only see endpoint diagnostics op the endpoint diagnostics option offered, we did not have a complete install. So that tells that just from a technical support support standpoint tells me that, the endpoint, only installed, the UI side and not the policy engine side. So it's not technically, doing any DLP work at that point, and and it could be considered a corrupt install. So it does have to have all of those menu options when you check it. And if you open it, for the open the DLP endpoint, you'll get a nice, little UI panel that, will tell you that the endpoint is enabled, which endpoint server it is connected to, the logged in user that it is going to report for those for any incidents that that that that handles. If you click on the time date stamp in the middle of the of of the endpoint UI, you will see the policy profile and fingerprint versions. We'll cover those in the next slide. So there's a lot of helpful information there. It can even indicate whether or not it is performing discovery scanning in that bottom pane of the endpoint UI. And so those are that those are all, you know, key indicators. Right? Did you did you see that all of the conversions are present for the profile and and and the policy? Is the time stamp that you selected to get into those versions a recent time stamp? Is is there a endpoint server listed and and everything shows connected? If any of those, aren't, as expected, agent may need to be looked at, and could be considered unhealthy or suspect. If the tray icon is just missing, there's a possibility that the remote desktop services have been disabled on on that particular Windows workstation. There's also there's also a likelihood that there was a checkbox checked during the install process to prevent the icon from appearing in the system tray at all. So you can have you can have it hit and install for for the product. There's a registry flag that we can flip that sometimes brings that icon back, but those are pretty much the only two. If the icon is missing, we either haven't installed it at all, RDS is disabled, or it's it's a stealth install. If any of those things look suspect, then, you know, common issues beyond RDS being disabled would be that the the encryption keys have had something happen to them and they no longer match. That can be a result of using a nonservice account to either run the installer for the DLP product or for the endpoint product. We, you know, we there are there are ways to solve that, but it it it can be it can be a heavy lift. Also, e AV and EDR interactions are quite common, Those typically just require us to make sure that all of the exclusions are in place. And then, of course, if you have an encrypted install path, it's been mentioned several times. It is very rare, but it can it it can create headaches, because it's not always, it's not always clear that that's what, the cause, is. Alright. And we're gonna move on to slide 15. I had mentioned a time stamp in the middle of the endpoint UI. My apologies. So we don't have an endpoint UI screenshot. But you you click on the time stamp in the middle of your endpoint UI, and there are three versions that version numbers that are offered to you. The first is your policy version, and you can look that up within the DLP console, like, on the policy management and then policies, you know, DLP or discovery, and then manage policies. And then there will be a number shown in the top right corner of that pane, and that number should match an updated endpoint for the policy version. If that number doesn't match, there may be an issue updating the endpoint and providing the most recent policies and profile, you know, data to to to those agents. So that is something to keep an eye out for fingerprint version. Same exact thing. It does need to match. You can look it up in the UI by going to policy management content classifiers and then file fingerprinting or database fingerprinting. The the the there won't be just the the for for the policy version, there isn't a difference between the DLP or the discovery. And similarly for the fingerprinter, we don't make a difference between a file or database versioning. So if if you see the you know, the it's it's version one zero nine for file fingerprinting. It is also version one zero nine for database fingerprinting. Profile version. This is a little bit different because there can be multiple profile versions in your environment. If you go in your DLP console UI to down at the bottom left, you click the deployment and then endpoint profiles, you'll then get a list, a table of the available profiles for your environment. For each row, the final column will tell you the profile version for that profile. And so if you have multiple profiles that are available in the environment, each profile will have a different version number shown. And then that number is what you would expect within the endpoint UI and and and then the current number. Right? So you would also maybe have a little bit of confirmation that it's even in the right, you know, profile family. If it's maybe a version or two behind, maybe just as an update. Again, maybe there's something that we need to look at as far as the profile. But sometimes you'll also find that it's in a completely different profile family, and it'll show, like, version seven thirty four. You're expecting one zero nine. Turns out it has reverted to the default profile, and it doesn't even doesn't even apply whatever you had in place for the intended profile. So keeping an eye on those versions within the endpoint UI and then making sure they match the version shown in the DLP UI and critical to understanding your agent's health. Let's see. Page 16. This is just a a brief overview of what the endpoint status page is going to look like from within the DLP UI. So if you're in the DLP console, you've got the top left icon status. If you collect data, oh, my apologies, status, then endpoint status that provides this page. There are a number of helpful columns, available. For initially checking agent's health, the synced column is going to be incredibly helpful and and and really apparent. Right? We use a red x or green check mark that gives you a a quick idea of which ones are going to be potentially out of out of out of sync and or impacted through one problem or another. There are some other there are some other important pieces of information that this pane can provide, including which endpoint server in that endpoint is connected to, the IP address of the reporting host, the host name, the logged in user, the last update time. So if you the last update time is very helpful for like, if you see that the endpoint hasn't updated since 2022, that that that endpoint has probably been deprecated. We we've we've decommissioned the workstation that that was on, and it's never gonna check-in again. In those cases, you can actually delete the line from endpoint status page, and then you don't have to you don't have to review that dead end point anymore. There is a linked article here that will help the the end users and your admins determine and troubleshoot issues with connectivity. Feel free to give that a a look if you're ever encountering anything you think may be a connectivity issue. Otherwise, as is in in most cases, feel free to feel free to open a case with tech support. Victoria, if we could move on to 17. Okay. So this is a little less hands on than the install process has been up to this point. That's the setup process has been because we're going to we're gonna leave we're gonna leave the endpoint and the workstation, and we're going to now operate almost entirely within this is this is all within the DLP console. So you're going to want to set up endpoint profiles. There are a number of there are a number of philosophies behind it. You can have, profiles for separate ADA groups, profiles for separate geographic regions, profiles for, workflows. There are, you know, a number of different ways that the endpoint profiles can then reflect how your organization is already deviated as a setup. Right? If you've got, if if you've got, you know, a a bunch of people in Europe and a bunch of people in America or a bunch of people in California, a bunch of people in New York, you could have, endpoint profiles that address those things and then apply either custom server connectivity details. So you have a set of endpoint servers in Europe and a set of endpoint servers in America, and then you tell each of those groups of employees that their endpoints go to those servers. Right? You can also, configure, languages within the profiles, and a a couple of other kind of helpful tailored to a specific group type configurations. They are different than our endpoint global settings, which is that next bullet point there. It's found in in a different location within our menu, settings, general, system, and then endpoint. And here, you'll have your global endpoint configurations. Right? So your anti tampering password. Update settings. You want it to check connectivity every ten minutes and download new pro profile and policy data every hour, or do you want that to be thirty minutes and every four hours? You want that to be five minutes and thirty minutes? There are the anti tampering password, for instance, is set there. And once that is updated there, it does update the the anti tampering password for all communicating endpoints. So if if they're currently part of the environment, they'll pick up that new password, and that does override any password that you may have con configured with the installer. Of note, if you did configure an anti tampering password in the installer, you installed the endpoint, and then it made its first contact to to the initial endpoint server, downloaded its profile and policy data, at that time, it will update to whatever the configured anti tampering password is from the manager. So if it is different in the manager than it was when you built the endpoint package, it it has, at that point, changed. There are some endpoint resources that can be configured, endpoint devices such as, like, a USB drive, endpoint applications, know, Notepad plus plus or something, office products. Many are predefined in the endpoint applications and application groups areas, but they do directly govern what types of analysis and enforcement we're gonna be doing against applications on the endpoint workstation. So if if you need to ensure that cut, copy, and paste are enforced against Excel, that does need to be configured within applications and application groups. If you need to turn off file access for browsers, again, done within applications and application groups. Without any DLP rules, all of what we've done so far is for nothing. We need to have, we need to have some kind of policy for the end endpoint to enforce. So, we would be doing that within, main policy management, either the DLP or the discovery policies, and then we would work through creating policy tailored to, you know, whatever our use case is. Source scope is so source scope makes you think that the product is going to know that in condition a, it does one thing, and in condition b, it does another thing. And those conditions are are called on network and off network. But that's a little confusing Because as long as the endpoint workstation can reach an endpoint server, it believes that it is on network. It will the that that that that connectivity test is is configurable. As as as as we mentioned above, it is configurable for your your update settings. So you can have it in five minutes, ten minutes for that. But if it can't reach an endpoint server, then it expects that it is off network. The the the real problem there is that most enterprises are gonna have a, you know, a a DMZ endpoint server. And so on network and off network, while the the the workstation is technically no longer on your network or when it's connecting to a DMZ endpoint server. It it still thinks it's on network. So so often, it's just a matter of fully understanding what on network and off network that that that that the condition a and condition b behavior is to to make sure that that's used in in a way that will meet a use case. But I I have seen that misinterpreted several times. And and, essentially, if the endpoint can connect into the environment, it it will be considered on network. Just wanna make sure that that was covered there. Your profiles does so thinking back to the table of endpoint profiles, if you have a custom profile for a a user and for some reason it does not load, you know, maybe there's a a resolution issue with the host, so we don't know that it's a part of a specific group or something. Right? The profile will default down the list of profiles till it gets to the the default profile. So you can rearrange your profiles to some extent and take to give them precedence and priority. Okay. And that was 17. So 18, endpoint troubleshooting. We've kinda touched on some of that throughout the discussion here. But let's see what so it's fairly straightforward for the upgrade. Once you've once you've built the installer, you can it's the same it's the same theory behind a a fresh install. Do it initially once manually to make sure that it does install manually. And then, you know, run run either your automated or your pushed update processes. Small groups at first, make sure that it works on the small groups, five or 10 workstations, and then, you know, larger groups as is appropriate for your organization. We have a quick mention here again of that web security auto update. It it that can't be used for the combined web and DLP packages. So you can have, a DLP only endpoint and a web only endpoint, or you can have a combined endpoint. If you do have a combined endpoint, you can't, you can't utilize that auto update feature there. With with the endpoints, there are few pre upgrade prerequisites, but you may want to, confirm versions, against our certified matrix. Not sure backing up existing endpoint profiles is strictly required, but it it could be a good idea. Post upgrade. Now this this is required. Must restart the endpoint, and then it is a good idea to confirm that the new versions are reported at least in the manager server, if not on the workstation themselves. Rollback. Rollbacks rollbacks will typically require you to fully uninstall the new, version and then do a fresh install of the older version. We don't have a downgrade available to us, and the installer will, in fact, fault if it sees that you're trying to install an older version on top of a newer version. Again, common issues, RDS, the build was faulty, so maybe the EPA got moved out of that client folder. Maybe there was missing the I'm missing a local config XML, missing certificate, something like that. There could be policy issues. May need to double check that the the AD or the AV and EDR exclusions are in place and being honored by the AV agent. Some endpoint diagnostic steps on our next slide, slide 20 here. The install folder for the endpoint is gonna by default is c program files web sense web sense endpoint. We do have a command w d e util. It gives us the ability to stop start the endpoint, disable anti tampering. We can do some log collections, some different service refreshes through that utility. It also gives us the ability to to do a super hook enforce kind the the changes how we how we enforce our exclusions for hooking. So there there are a number of things that WDE Util does, and we, will often from from the support team, will often ask, our the the end our partner administrators and end users to to run WDE util commands for one reason or another. So knowing knowing at least the the the the the the basic stop all and start all or set disable anti tampering equals true commands is helpful. We have just a brief slide on connectivity troubleshooting on 21. This does mention our local config XML in the validate step. Right? Local config XML is important because it's gonna contain all of our endpoint connection URLs for for the workstations to use to, you know, download the policies and profiles and submit incident data. Those are gonna be listed as a secure HTTP URL with the endpoint server, fqdn/ep/endpointserver.dll. If the if if you if you just go into local config, copy that URL into a browser, you should then show WebSense DSS endpoint server as as an output, just block text on a white background. If you don't see that, there's probably a network issue in between the workstation and the endpoint server, or the endpoint server process is not functional on that endpoint server. If you do notice some connectivity issues and you do have the ability to do so, disabling anti tampering, enabling client communication debug levels for that topic, reproducing the issue, and then collecting some client info logs could show us everything we need in order to move forward with providing a resolution. Our next slides 22 has just a couple of best practices on it. Always run package builder, log in as a service account, use the phase rollout, maintain a version controlled library of package builds. This is from a from a support standpoint. This is really helpful sometimes. So the when we're working with with a customer and we get into their repository for their prior builds and we see that every build has its own folder, every folder has, you know, all of the different builds for that version that they've been using in their environment. And so it it's helpful when trying to determine aspects of of a of a case when we find that kind of information available. So just having a version controlled library of all of your builds make them in handy one day. Again, best practice for the AV and EDR, and we must have those exclusions in place. Otherwise, there can be unwanted behavior at the endpoint level. Most of the time, that means we're not going to be enforcing. Other times, it could be that we're enforcing incorrectly or that we're reporting things with errors. But AV does does cause trouble when it is monitoring our processes, which are monitoring their processes. Schedule regular health reviews, either using the security manager or, a small sample of in person eyeball type checks. You know, if if you can if you regularly see in the manager server that everything is synced and connected and updated, that's a great that's a great indicator of of environment health. Similarly, if you lay eyes on a couple of workstations and investigate the the the the icon, open it up so you can see the time stamp, Click the time stamp so you can see your versions, and then confirm that those are all synced. That that also will help you maintain a a a a pulse a a finger on the pulse of the environment. So this is kind of a corner case recommendation, but if you're going to be using GPO, you can disable the command prompt policy option, set it to no. 23 is just an another little bit of install. We have a page on downloading again. I think we can skip that. Oh, page slide 25. We've got the actual build process shown with the different wizard pages. If We already did describe what's going on here. So the the the first is your components where you'll select. Is it a web security? Is there a DLP option? There's a language to to choose there. That second pane is where you choose your platform and set your anti tampering password. That third pane is gonna be your initial endpoint connection where there's an IP or FQDN provided. There's some other information there that most people don't configure, but you you may find need for. That fourth, the first pane on the bottom row, is just, you know, it's where we're saving the installation package. That fifth, pane, second on the bottom row is going to be the pop up you receive when it has successfully written the installer package. And then we had a screenshot of where that gets placed. On page 26, we have, some different options for how to, do the install process. So we have, the command line, shown with, a way to trigger it as a, quiet or silent install. We also show a tag that is required for over the top upgrades when you need to clear configuration data. So that third that third grouping of of commands there, the slash v, quote, w s u d p f equals d l p plus, unquote, that quoted section there tells it to target the DLP endpoint and to overwrite things like the local config XML, the CA dot CER certificate, some of the other some of the other environment configuration details. On page on slide 27, we have a couple more screenshots of what, what it's gonna look like, after you've installed it. So if you try to uninstall the product, you're gonna get that first pane, the the pop up that's requesting the anti tampering password. If you get if you do actually trigger a block, you'll get the, little kinda grayish blue icon with the warning message that is shown in the bottom, right or bottom left corner of, that slide. And then on the right side of that slide, you'll see the endpoint UI. I've referred to this a couple of times throughout throughout the presentation. It does show username, your connection status, and the the the endpoint server it's connected to in that top section. Then it's got, you know, the profile name, its current status, and that time stamp that I've referred to several times in that middle pane. That bottom pane covers endpoint discovery. The time stamp is again, it's it's a hyperlink. So if you click on that, it'll pop up another window which will show you your policy profile and fingerprint versions. Alright. And briefly, we're going to go to 28 and then '29. We're, gonna gonna touch on, custom message files. So, you can see what they'd look like in the, file structure in that pane in the top right, and then some highlighted configuration areas for endpoint profile data down in the bottom right. And then it's kind of an overview of how those get edited on the left. We do have We do have and I think it was in one of the earlier panes about, the customized messages. We do have a great document that, covers how to, make these, whatever it is that you want them to say, within whatever their limitations are for the specific messages. Some do have character limitations. Some aren't capable of presenting, say, HTTP, that kind of thing. On pay on slide 30, we have a bunch of our helpful documents and different resources that are available to you through our support site. And we can use the last couple of minutes for some q and a. Although, it looks like Roger has been on top of on top of answering all of y'all's questions. Thank you for keeping him occupied. I I I didn't want him to to to to fall asleep or anything, so I'm glad that has worked out. We have some early submission questions. Let's see what we've got. Well, my uncle was a is a electronic engineer. Wrote books on flip flops and what the electrons are doing. And he always had a problem with closed systems that then experience faults, which is essentially what you're referring to there. Right? Why do we have something that's working that then stops? There are a ton of reasons, and I I have seen basically every flavor at this point in time of why why a properly installed product that has been running well for weeks or months just stops. Right? Typically, it is something else caused that rather than the the the the complaint my uncle had with a closed system just died. And so maybe your AV product didn't update right. Otherwise, it was working fine. But that now it doesn't have one of the configured exclusions. And so it looks at one of our files at a really inopportune time. Maybe we need to be reading it or writing it ourselves. And then now that has corrupted our install. You know, the there's a million different scenarios along those lines. There's there's some spots. There's the you know, there there can bits can just flip. So also, basically, every security agent, every product has this kind of thing. Right? Ours is just very visible because of what we do. So you you know, it's it's kinda everybody everybody sees a problem on the computer. The first thing they go to is the AV and their security tools. Right? Oh, it must be the security tool causing the problem. And it probably is. Right? But there there are so many different reasons how we get to that that, yeah, I I I can't I I can't give you this is exactly why it becomes suddenly corrupted. If you do run into something like that, though, feel free to open up a case. We will investigate that specific scenario, and we'll get you an answer. Do we support OCR scanning for extracting text from images at the endpoint level? Not yet. We don't. It will be I don't have a I'm gonna see if I can get a date for y'all or at least some additional information on OCR at the endpoint. I know we are working on it, but let's see if we can get you an exact one. I'll move on in the meantime. Intune support oh, and demo. We do the the the product can be deployed by basically any enterprise deployment tool. We offer some limited guidance on a couple of tools. We do have some articles about my apologies. We weren't able to get to a demo for that today. RRDB functions and troubleshooting. The resource resolver database is very much that. It it it it's it's resolving resources for us. So it might have a UID or some other tag or or indicator, and then we'd use, you know, that to put together the the the the the the policy workflow as we're analyzing a transaction. Troubleshooting that is not probably something that should be done by an end user or an organization without at least guidance of the technical support team. So if you are in a position where RRDB seems to be impacted, you can go ahead and open up a case, and we will assist we will assist you. Can we block to GitHub post? I believe we can, but it does require some additional configuration of, say, endpoint applications or endpoint application groups. Don't hold me to that. And if you if you aren't able to just come up with it, again, feel free to open a case with us. We're, here to assist, y'all in making sure you see see value out of this tool. It it is incredibly powerful, but that can also mean that it can can be overwhelming or complicated to the point where, you know, you you guys don't yeah. Psychologically, you may not wanna reach out to us and just do it. You know? Let us help you, make this product, exactly what you want. Different departments are looking to share their records due to the criticality. Instead, make sure Kaywin's policies are configured based on the. False positives can be handled in a number of different ways. We do have an article that covers reducing false positives. But, typically, you're going to want to identify something within the false positives that you can use as a trigger to exclude. So moving on. How do we verify the legitimacy of an incident if we do not have access to the document, do not have rights to forensics? To a certain extent, you can trust the product. You know, how how can we verify the legitimacy of an incident if we do not have access to the document and you do not have rights to forensics data? I mean, at that point in time, you you the the there really is there really is maybe a need for faith. You can you can back up a forensics investigation with a lot of data. But if if you don't have if you don't have the source data or access to it to confirm whether or not that incident should have been triggered in the first place, it can get difficult. Then the the the they're they're they're you you you you're getting the stuff that's completely above my prognostication here. Right? I mean, it's it's do you trust the user? Do you innocent until proven guilty, that kind of thing. Right? But it trusts the product. The the product saw something in that transaction that made it act. And most of the time, we do act appropriately. What should be the the ideal incident response flow? What minimum rights are required for the incident responder role? And who should be involved in the investigation? Minimum rights required for an incident responder role. I I think we even have a predefined role in the DLP product that would meet that need. If not, the the roles can be customized significantly to to tailor access, but I can't answer the other two sides of this, question. Alright? What should be the ideal incident response flow? That's that's gonna be something your organization needs to to to look at. I mean, incident happens. People get notified. There's an investigation. Now they clear the incident or you fire the individual. And, I mean, that's that that's gonna be up to y'all and use some, you know, information security best practices on that one. And and who should be involved in the investigation? Again, that's that's gonna be something your organization is gonna need to just determine internally. How to easily and effectively update the DLP agent on a Windows computer using an MDM tool like Intune? The document describes this as a process of uninstalling the old version, restarting the computer, installing the new version, and then restarting the computer again. That would be, that would be a workable process. That is something that you could do. However, you can also pass, the the WSUDPF flag with the, with the installer. If you pass that, you can just, do an on top upgrade where all, of the configurations are cleared out. And so you shouldn't need to do an uninstall, restart, and then do the install. Some scenarios are going to require that you do the uninstall and then, you know, restart and then do a a reinstall. Most of the time, those are going to involve corrupted endpoints, but, it it the the the there there still are scenarios where there will be multiple restarts in an upgrade process, unfortunately. All all mobile device management tools should be able to handle the process, not just in June. So but we will not we don't provide guidance for anything that's not, like, in June. Need clarity on DLP agent endpoint twenty five zero eight version issues. Every version of the endpoint is gonna have its own set of idiosyncrasies. The latest endpoints are the best endpoints we've ever made, and they keep getting better. So if there is something with twenty five zero eight that is not what you need, my suggestion would be try 2509, 2511, or twenty six zero two. Otherwise, there are known and resolved issues documentation for each version. I would suggest taking a look at. Why Forcepoint does not support Linux agent? We just we don't have one at the moment. I believe there are plans to get one put together and available for our end users, but we don't have we don't have a date, an estimate on that at the moment. We'll enforce AI on browser file upload and chat. So we've made lots of strides against AI recently. Most sites All of the major AI is going to have, you know, at least the basic functionality of blocking file upload, chat, dissemination of data, that kind of thing. It does require the most recent endpoint or endpoint versions so that we can enable different analysis and interception methodology. As as long as long as as long as we can see the data, we can enforce against it. So that's yeah. And and at this point in time, again, the major AI sites, do okay with. Now the exception to that is, I I believe, at the moment, embedded AI. So, like, if you guys have Claude or Copilot in Excel or PowerPoint, I don't I we we don't, at this time, monitor that transaction. So Claude or or or Gemini or Copilot, whoever, is going to go from that you know, the whatever the embedded product that it's in is to its servers and things like that. We we're not we're not watching that chain at this time. That but that is planned for future products. And that is all of the early. submission questions. And we are over time. I know. I see the number starting to go down. So apologies that this was an amazing topic. Any questions throughout? Thank you, Roger, for, you know, again, popping into the q and a here. But any other questions, please feel free to pop them in. I think the session will stay live a quite couple minutes longer that we can go through. The presentation slide, you will get the recording emailed to you after today's session. You can also click on that Docs tab at the top right of your screen and access the deck from there. Denny, just hope that answers your question. And I'm gonna pop up. Let's see if I can do this. I'm gonna launch a survey real quick. These are just a couple of session questions. Hope you all are seeing it. And feel free to stay on, Again, to complete that survey or again to pop into chat any last minute questions. We'll hang out for a few more minutes. Tim, great job. I'm sure your your brain is going a million miles a minute. I could totally tell. is a it it it is a topic, and it's it's sometimes beating. Yeah. it it it's it's hard to boil it down into an hour. Oh, as I see. yeah. But all amazing updates and amazing questions that were submitted, so thank you for covering that in quite detail. Ended. Ended. Yeah. And thank you to our wonderful emcee today. Yeah. Round of applause for Victoria, All. I did was click a button, Tim. You did all the hard work, heavy lifting. You too. Team effort. It is a team Yeah. effort. Yeah. Alright. I'm gonna go ahead and close the survey. Again, it looks like looks like a quiet audience, so we can we can hop out. But thanks again to everybody for joining us today. Thank you, everyone. Follow us on social. Yeah. Bye, y'all. Alright. Bye, guys. Thanks.