Technical Anshu
Tutorials Blog
🛡️ Data Loss Prevention

Prevent Data Leakage with ManageEngine DLP Complete Setup Guide

A pen drive, a personal Gmail tab and one careless copy — that is how most office data actually leaves. ManageEngine Endpoint Central's DLP and Device Control modules close those doors from one console. This guide sets it up step by step, and sets it up fairly: audit first, block later, and tell your staff before you switch anything on.

✍️ Technical Anshu🛡️ ManageEngine Endpoint Central⏱️ Admin guide
🎥 Watch the full DLP setup in the video — every policy screen, step by step

Every office has the same quiet problem. The salary sheet goes home on a pen drive. The client list gets uploaded to a personal cloud account "just to work from home". A drawing file leaves as an email attachment to a personal ID. Nobody means harm — but the data is gone, and you cannot prove where it went. Data Loss Prevention (DLP) in ManageEngine Endpoint Central watches exactly these exits: USB and other peripheral devices, file transfers, email domains, cloud uploads and printing. Below is the complete setup in the order a careful admin should do it — inventory first, audit second, blocking last.

Endpoint Central — Where the Data Exits Are (overview)
USB and removable storageDevice Control
15+ peripheral device typesControlled centrally
Email to outside domainsDLP policy rules
Uploads to cloud storage and web appsDLP policy rules
Printing sensitive filesPrint control + logs
Every file copied to a deviceFile tracing report
Overview panel based on the official ManageEngine feature list. The exact screens depend on your Endpoint Central edition and build.
1

Step 1 — Confirm Your Edition Before You Plan

DLP and Device Control are add-on modules in Endpoint Central; they are also bundled in the Security Edition. Menus differ slightly between the on-premises console, the cloud console and the standalone Endpoint DLP Plus product, so do not copy a screenshot from the internet blindly.

  1. Open your Endpoint Central console and check which security add-ons your licence includes
  2. Confirm the Device Control and Endpoint DLP sections are visible — if they are missing, it is a licence question, not a setting you broke
  3. Make sure agents are deployed and reporting on every computer you plan to protect — a PC without an agent is outside every policy you write
2

Step 2 — Take a Device Inventory First

Blocking devices you have never counted is how admins lock the accounts team out of its own printer on salary day. Start by seeing what is actually plugged into your network.

  1. Run the device and file-action reports in audit-only mode for a few days — every device is allowed, but every connection and file action is logged
  2. Note the regulars: office printers, scanners, the accounts team's pen drives, drawing plotters, banking dongles
  3. This list becomes the base of your trusted devices list — policy written from real data, not guesses
3

Step 3 — Build the Trusted Devices List

The trusted list is the heart of device control. Devices on it work normally; everything else follows the strict rules. Endpoint Central can also add whole families of devices with wildcard patterns.

  1. Add each approved device by its identity (device instance / hardware ID), not just by model name
  2. Keep one list per need — a device trusted on the design PC is not automatically trusted on the server
  3. Review the list monthly. People leave, pen drives get lost, and yesterday's trusted device is today's hole
4

Step 4 — Set USB and Peripheral Rules by Department

One rule for the whole office is either too loose for accounts or too tight for everyone else. Endpoint Central controls 15+ device types — USB storage, CD/DVD, Bluetooth, portable devices, printers and more — and policies can differ per user group or computer group.

  1. Accounts and HR systems: USB storage blocked or read-only, because salary and personal data live there
  2. Design and site teams: transfers allowed to trusted devices, with file tracing on
  3. Reception and shared PCs: the strictest profile — nobody's personal pen drive belongs there
5

Step 5 — Add File Rules: Type, Size and Destination

Device rules decide where a file can go. File rules decide what can move. Used together they stop the classic accidents without stopping real work.

  1. Set a maximum file size for transfers to removable devices — a 2 GB database backup has no business on a pen drive
  2. Restrict sensitive file types and extensions your office actually fears losing: drawings, spreadsheets of accounts, database exports
  3. Use the DLP policy to allow email with attachments only to permitted domains, and to stop uploads of office files to personal cloud storage and web apps
  4. Turn on print control for sensitive data and keep print activity logs — paper is a leak channel too
6

Step 6 — Switch On Tracing, Shadowing and Alerts

Blocking stops the copy. File tracing tells you what already moved: which file, to which device, by which user, from which computer, at what time. File shadowing goes one step further and keeps a mirrored copy of transferred files in a secure location, so an investigation never depends on the pen drive coming back.

  1. Enable file tracing on all managed systems from day one — it is read-only evidence, not a restriction
  2. Enable file shadowing for your most sensitive shares, with size and extension filters so storage stays sane
  3. Set real-time alerts for blocked attempts and for user overrides, so exceptions reach you the same day, not in a monthly report
7

Step 7 — Roll Out Fairly: Audit, Announce, Then Block

The technically perfect setup still fails if staff experience it as a trap. The honest order is the one used in this guide:

  1. Run audit-only for two to four weeks and study the reports
  2. Announce the policy in writing — what is blocked, what is logged, and the reason: client data and the company's legal duty to protect it
  3. Open a clear exception route — temporary access for a genuine need, approved and time-limited
  4. Only then move department by department from audit to blocking, starting with the highest-risk data

🎥 Watch the Complete Setup in the Video

The complete on-screen walkthrough — device control, trusted list, DLP policies and reports — is in the video. Watch it before your rollout meeting.

▶️ Watch Full Video
❓ Common Questions (FAQ)

Is DLP included in every Endpoint Central edition?

No. Device Control and Endpoint DLP are add-on modules, and they are also bundled in the Security Edition. Which console screens you see depends on your licence and whether you use the on-premises or cloud console — check your licence first, exactly as Step 1 says.

Will DLP stop a determined employee from stealing data?

No tool can promise that, and this guide will not pretend otherwise. DLP closes the easy, everyday exits — pen drives, personal email, casual cloud uploads — and records what moves. A determined insider with a phone camera is a management and legal problem, not a software setting.

Should we switch on blocking on day one?

That is the fastest way to break real work and lose the staff's trust. Run audit-only mode first, announce the policy in writing, open an exception route — then block, department by department. The settings take minutes; the fairness is what makes them last.

This guide is based on the ManageEngine DLP video by Technical Anshu • Stuck on a step? Ask in the video comments — answers happen there.