Rules do not function when applied through an Active Directory security group

Technical Articles ID: KB87730
Last Modified: 12/22/2021

Environment

McAfee Data Loss Prevention (DLP) Endpoint - all supported versions

For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.

Problem

When DLP Endpoint rules are applied through an Active Directory security group, they do not function.

Cause

DLP Endpoint relies on the client system to correctly report the assigned Active Directory security groups for the logged on user. It then uses this information to apply rule enforcement.

Solution

Use the Microsoft GPResult utility to determine which user groups are currently applied to the logged-on user:

Open a command-line session.
Type gpresult /User <username> /v > c:\gpresult.txt and press Enter.
View the output in c:\gpresult.txt, specifically the security groups applied to the user in the section titled:
The user is a part of the following security groups.
- If the output does not report that the affected user ID has the correct security group membership, DLP Endpoint is functioning as expected. The environment's domain administrator must investigate the issue.
- If the output does report that the affected user ID has the correct security group membership:
  1. Check for the issue documented in KB86338 - Data Loss Prevention Endpoint rules are not enforced on users or groups in User Assignment Group, and follow the solution if needed.
  2. If the issue persists, run the WebMER tool to gather the Minimum Escalation Requirements (MER) for Data Loss Prevention Endpoint and open a support case with Technical Support. For more information, see KB59385 - How to use MER tools with supported McAfee products.

NOTE: For additional information regarding the GPResult utility's use and syntax, see: https://technet.microsoft.com/en-us/library/bb456989.aspx.

Workaround

Apply the rule through explicit individual user assignment or organizational unit (OU).

Affected Products

Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.4.x (EOL)
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Rules do not function when applied through an Active Directory security group

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Rules do not function when applied through an Active Directory security group

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title