I am running a new install of 11.6.2, and we are putting in some Policies and Responses to do some testing. Using a simple policy to create incidents for social security numbers using the data identifier we can see incidents for Network Monitor, Email Prevent, and Network Discover. We are getting bizarre results with Endpoint. We have two Windows 7 hosts with the agent. We have an Endpoint block as a response with no exemptions. The endpoint configuration is set to look at everything except "copy to share" and "outlook". We are a Notes shop. Both workstations show up with a green light.
On the first, sending an attachment and copying a file were blocked. Copying to the clipboard and printing and putting the social security number in the search bar of Google on IE were not. On the second, nothing was blocked, we rebooted, then sending an attachment, copying to the clipboard, and printing were blocked.
Rebooted the first machine and nothing was being blocked. Rebooted the second machine and email wasn't blocked but printing was. I didn't get to test more functions as the users went home with their laptops.
Also on the first machine if you typed a SSN in a new email it was blocked. If you forwarded a mail that had been sent back an forth a few times, meaning the number was deeper in the mail, it was never blocked.
Any ideas?