Recommended next steps:
Currently there are no additional mitigation steps that can be offered by Forcepoint.
- Microsoft has delivered a fix for this issue.
- Please update “Office App” to the latest release (18.2001.1241.0 or greater) and then remove the PAC file URL from Internet Options.
- Contact Microsoft Support for assistance updating the “Office App” to the latest release.
Forcepoint investigated this issue and has determined that it is not linked to the design nor the behavior of the Endpoint agent. It was narrowed down to be caused by the ‘localbridge.exe’ process that is part of the Microsoft Office suite, specifically an application called the "Office App" which comes bundled with Windows.
- Why it shows the Forcepoint URL: It was the last URL that was enforced on these systems when the previous Forcepoint PCEP client was in place.
- We have concluded that the Microsoft Office App is responsible for the re-application of the PAC file URL.
- Forcepoint Engineering has created a developer support case with Microsoft.
- This may affect any Cloud Web or Hybrid Web deployment that used the PCEP endpoint at some point previously.
- Because this issue forces a PAC file URL in place, the symptoms of authentication prompting are most commonly experienced by users that currently have the Direct Connect Endpoint Client (DCEP), or previously had Proxy Connect Endpoint client installed on the system in question.
pac; pcep; endpoint; proxy connect endpoint; office; msoffice; registry; localbridge; office app; coexistence; uninstall