# Understanding Data Loss Prevention

**Endpoint Central**'s Data Loss Prevention provides a robust layer of security by preventing unauthorized access and leakage of sensitive data. This document delves into the specifications of the agent processes and the core mechanisms behind Data Loss Prevention, helping you understand how it safeguards your endpoints and protects critical information from unauthorized exposure.

## Table of contents

- [Supported Operating Systems](#supported-operating-systems)
- [Specifications of Agent Processes](#specifications-of-agent-processes)
- [Policy Deployment: Agent-Server Synchronization](#policy-deployment-agent-server-synchronization)
- [Policy Enforcement in Agent](#policy-enforcement-in-agent)
- [Sensitive Data Discovery](#sensitive-data-discovery)

## Supported Operating Systems

| OS 1 | OS 2 | OS 3 | OS 4 |
|---|---|---|---|
| Windows 11 | Windows 10 | Windows 8.1 | Windows 8 |
| Windows Server 2022 | Windows Server 2019 | Windows Server 2016 | Windows Server 2012 R2 |
| Windows Server 2012 |  |  |  |

## Specifications of Agent Processes

| Agent Process | Running Device Name | Bandwidth Consumption (Approximately) | CPU Consumption (Approximately) | Memory Consumption (Approximately) |
|---|---|---|---|---|
| Processing EDLP Policy | Medlp.exe | N.A. | <0.5% | 20–22 MB |
| Classifying Process | UemsProcessMonitor.exe | N.A. | 0.11–0.13% | 23–25 MB |
| Network Packet Monitor | Netfilter.exe | N.A. | <0.1% | 6–8 MB |
| Clipboard Monitor | HostExe | N.A. | <0.1% | 3–4 MB |
| Monitoring Browser File upload | DLPNativeHost.exe | N.A. | <0.1% | 10–11 MB |
| Component Upgrade | meaaphelper.exe | 14–17 MB | 0–1% | 1 MB |
| **Build after 11.4.2504.01 (UemsProcessMonitor.exe is merged with MEDLP.exe)** |  |  |  |  |
| Processing DLP Policy and Process Classification | Medlp.exe (During background scan and process classification) | N.A. | 10–20% | 25–120 MB |
| Processing DLP Policy and Process Classification | Medlp.exe (After background scan completion) | N.A. | <0.5% | 20–25 MB |

## Policy Deployment: Agent-Server Synchronization

![Policy Deployment](https://www.manageengine.com/products/desktop-central/help/images/ac-policy-deploy-hw.png)

When a Data Loss Prevention policy is created, it is deployed in the following two options:

- **Deploy Immediately** option: The policy is immediately pushed to and applied on agent machines that are currently online. For large CGs (over 200 machines), the policy is applied to 200 machines initially, with the rest following in the next refresh cycle.
- **Deploy** option: The policy is scheduled for the next 90-minute refresh cycle.

Policy modifications, deletions, group changes, and unmanaged device updates are synchronized with agent machines during refresh cycles. In environments with a Distribution Server, policies and configurations are replicated to the Distribution Server and then synchronized with agent machines during the 90-minute refresh cycle.

## Policy Enforcement in Agent

The Data Loss Prevention policy will be received by the agent and enforced by the kernel mode driver named medlp. This driver monitors device connections and ensures that only authorized devices can be accessed according to the deployed policy. Audited and blocked device events will be posted in the 90-minute refresh cycle.

![App Request](https://www.manageengine.com/products/desktop-central/help/images/edlp-agent-working.png)

## Sensitive Data Discovery

After agent installation, the agent remains dormant until a policy is deployed. Once a policy is in place, the agent scans endpoints for sensitive files based on the defined rules.

Additionally, OCR (Optical Character Recognition) support enables the agent to identify sensitive information even within image-based documents.

To view the complete list of supported file formats, refer [List of supported file formats](https://www.manageengine.com/endpoint-dlp/supported-file-extension.html).

### Endpoint DLP Conflict Precedence

When conflicting policies are applied to the same target group, the following is the order of precedence:

1. Block
2. Allow within Trusted
3. Audit Only

For example: In Endpoint DLP, if a block policy conflicts with an "Allow Trusted" rule, the sensitive file will be blocked.