Lockbase Cyber Purview Assistant

Tool / On-device

Endpoint DLP

See the current state of Microsoft Purview Endpoint DLP on a device: onboarding, the Defender settings DLP relies on, the DLP client, and the synced policies — decoded. Run the collector on the device, then load the snapshot here. Everything renders in your browser.

Talk to an ExpertGet help with your Purview deployment

Runs entirely in your browser The snapshot you load is parsed locally and never sent anywhere (a Content-Security-Policy blocks all outbound connections). A snapshot can contain device and tenant identifiers (Org ID, Device ID, onboarding blob), so treat the .json file as sensitive and share it only as your organization allows.

Load an Endpoint DLP snapshot

Drop a EndpointDlpState_*.json file here, or…

Need the collector? Download Get-EndpointDlpState.ps1, then run it on the device you want to inspect.

How to generate a snapshot on the device
  1. Download Get-EndpointDlpState.ps1 and copy it to the device you want to inspect.
  2. Open an elevated Windows PowerShell prompt (Run as administrator) in that folder and run:
    powershell -ExecutionPolicy Bypass -File .\Get-EndpointDlpState.ps1
    It prints a pass/fail summary and writes EndpointDlpState_<host>_<timestamp>.json in the current folder.
  3. To decode the actual synced policies, also run the official MDE Client Analyzer, extract its MDEClientAnalyzerResult_<ID> folder, and point the collector at it:
    powershell -ExecutionPolicy Bypass -File .\Get-EndpointDlpState.ps1 -AnalyzerResultPath C:\path\to\MDEClientAnalyzerResult_XXXX
    The live on-device policy cache isn't always present in a readable form, so the analyzer output is the reliable source for the policy JSON. Without it, everything except the decoded policy still works.
  4. Bring the resulting .json here and load it above.