×
×
×
×

Understanding Data Loss Prevention

Last Updated On: 24 Jul 2026|
6 minutes read |

Endpoint Central's Data Loss Prevention provides a robust layer of security by preventing unauthorized access and leakage of sensitive data. This page covers the specifications of the agent processes and the core mechanisms behind Data Loss Prevention, helping you understand how it safeguards your endpoints and protects critical information from unauthorized exposure.

Supported Operating Systems

OSOSOSOS
Windows 11Windows 10Windows 8.1Windows 8
Windows Server 2022Windows Server 2019Windows Server 2016Windows Server 2012 R2
Windows Server 2012

Specifications of Agent Processes

Agent ProcessRunning Device NameBandwidth Consumption (Approx.)CPU Consumption (Approx.)Memory Consumption (Approx.)
Processing EDLP PolicyMedlp.exeN/A<0.5%20—22 MB
Classifying ProcessUemsProcessMonitor.exeN/A0.11—0.13%23—25 MB
Network Packet MonitorNetfilter.exeN/A<0.1%6—8 MB
Clipboard MonitorHostExeN/A<0.1%3—4 MB
Monitoring Browser File UploadDLPNativeHost.exeN/A<0.1%10—11 MB
Component Upgrademeaaphelper.exe14—17 MB0—1%1 MB
Build 11.4.2504.01 and above (UemsProcessMonitor.exe is merged with Medlp.exe)
Processing DLP Policy and Process ClassificationMedlp.exe (during background scan and process classification)N/A10—20%25—120 MB
Processing DLP Policy and Process ClassificationMedlp.exe (after background scan completion)N/A<0.5%20—25 MB

Policy Deployment: Agent-Server Synchronization

Policy deployment diagram showing agent-server synchronization flow between the Endpoint Central server and agent machines
Agent-server synchronization flow for DLP policy deployment.

When a Data Loss Prevention policy is created, it is deployed using one of the following two options:

  • Deploy Immediately: The policy is immediately pushed to and applied on agent machines that are currently online. For large custom groups (over 200 machines), the policy is applied to 200 machines initially, with the rest following in the next refresh cycle.
  • Deploy: The policy is scheduled for the next 90-minute refresh cycle.

Policy modifications, deletions, group changes, and unmanaged device updates are synchronized with agent machines during refresh cycles. In environments with a Distribution Server, policies and configurations are replicated to the Distribution Server and then synchronized with agent machines during the 90-minute refresh cycle.

Policy Enforcement in Agent

The Data Loss Prevention policy will be received by the agent and enforced by the kernel mode driver named medlp. This driver monitors device connections and ensures that only authorized devices can be accessed according to the deployed policy. Audited and blocked device events will be posted in the 90-minute refresh cycle.

DLP agent enforcement diagram showing how the medlp kernel mode driver monitors and controls device access on endpoints
DLP agent enforcement diagram showing the medlp kernel mode driver's role in policy enforcement.

Sensitive Data Discovery

After agent installation, the agent remains dormant until a policy is deployed. Once a policy is in place, the agent scans endpoints for sensitive files based on the defined rules.

Additionally, OCR (Optical Character Recognition) support enables the agent to identify sensitive information even within image-based documents.

To view the complete list of supported file formats, refer to List of Supported File Formats.

Endpoint Central Conflict Precedence

When conflicting policies are applied to the same target group, the following order of precedence applies:

  1. Block
  2. Allow Within Trusted
  3. Audit Only
Example
In Endpoint Central, if a block policy conflicts with an "Allow Trusted" rule, the sensitive file will be blocked.

Related