Additional information about DLP User Information:

For DLP Endpoint for Windows, the DLP Agent collects user information that is stored locally on the Windows system. It does not gather user information by connecting to an LDAP server.

The DLP Agent must automatically collect the UPN, FQDN, and User name details needed and provide to ePO. Sometimes, these details might not be available on the endpoint, which results in an inability for the DLP Agent to provide such information. The WHOAMI command with the following switches can be run on the endpoint to verify if Windows has the user information stored locally.

WHOAMI [/UPN | /FQDN | /USER]

Columns that contain an “optional” header in the User Information .csv file are values that are NOT automatically collected by the DLP Agent. If you require data in these fields, they must be manually edited.

Before importing the User Information .csv, all fields in the file must be comma delimited and the file must be saved in the CSV (comma delimited) format. The file import with either fail or not update User Information properly if formatted otherwise.

When you update the User Information, the user information in all pre-existing DLP incidents associated with the updated users, is also updated.

User Information can be updated using the REST API. For details, see KB87855 - REST API for Data Loss Prevention Endpoint definitions sample.

For User Information that Logon Collector can gather, see the “Integration with Data Loss Prevention” section in the Logon Collector Product Guide.

DLP Prevent and Monitor appliances can communicate with LDAP servers to obtain Active Directory User Information. An LDAP server must be registered with ePO and configured in the Users and Groups policy, as described in the DLP Product Guide. If you suspect that your appliance is not properly gathering the User Information details, contact Technical Support for assistance.