Dear ManageEngine community,

We are currently testing a potencial DLP/Data Protection solution that will fit our needs. Little about current test environement configuration:

While testing a solution we wanted to highlight some issues we met during the policy test phases.

We have files on a network share, labeled as Restricted. These files must not be copied to local folders such as Desktop. Clipboard policy is in place on Endpoint DLP and set up to display an alert.

When user copy a file using a menu in file explorer, policy works and prevents a copy action.

When user drags the same file from a share folder to desktop, policy is NOT activated. This way user can bypass the security and copy the file further to unprotected shares without being detected.

Simmilar to previous issue, but with files labeled as Restricted in mail attachments. When user drags the same file that should not ce copied to new mail form and press send, that mail is not prevented by the Outlook plug-in. We could see that the plug-in registered the outgoing mail along with atachment, but didn't recognise that attachment had a label.

The test file is labeled manually, we don't know where the file label information is kept but it's not transmited with the file when the file is added as attchment to the Outlook.

In Risk Analysis there is an option to add a classification profile that will mark all files matched by a policy with a label. While adding a new profile, classification label drop down was empty even there are four predefined categories of labels. So we created a new label called "Restricted".

We defined file match rules and policy before. Then we initiated a full scan of the file share.

When the scan finished, we analysed the results and most of the files matched our policy, but with the issue that only Office documents were labeled according to the results. Other types such as txt, zip etc. were not labeled even they matched a policy.

Then we wanted to double check if the labeled files were really labeled. Came to the workstation and checked the file, but the file had no label attributes.

This may be an issue with custom labeling, but we are not sure why this is happening. Domain account used to scan Windows domain has modify rights on a share.

These issues may be caused by a bug or a current limitations. It will be great if these issues can be somehow resolved. If we did not pay attention to something we would be happy to hear from you.

Thank you.