KB Article | Forcepoint Support

Notes & Warnings

Important This issue can affect any internet traffic.
  • This refers specifically to a known issue caused by the Office App, an application from the Microsoft Office Suite for interfacing with O365, which can affect any internet access.
  • This issue may not cause any symptoms within Microsoft Office.
  • If not using Microsoft Office Suite in the environment, see PAC file remains after uninstalling Web Endpoint.

Problem Description

The Forcepoint PAC file URL reappears unexpectedly on Windows systems within LAN settings that previously had the Forcepoint Proxy Connect (PCEP) Endpoint installed.
 

Resolution

Forcepoint has been investigating this issue and has determined that it is not linked to the design nor the behavior of the Endpoint agent. It has been narrowed down to be caused by the ‘localbridge.exe’ process that is part of the Microsoft Office suite, specifically an application called the "Office App" which comes bundled with Windows.
  • Why it shows the Forcepoint URL: It was the last URL that was enforced on these systems when the previous Forcepoint PCEP client was in place.
  • We have concluded that the Microsoft Office App is responsible for the re-application of the PAC file URL and that by uninstalling the Office App, the issue is permanently resolved.
  • Forcepoint Engineering has created a developer support case with Microsoft and the issue is still under MSFT investigation.
  • This may affect any Cloud Web or Hybrid Web deployment that used the PCEP endpoint at some point previously.
  • Because this issue forces a PAC file URL in place, the symptoms of authentication prompting are most commonly experienced by users that currently have the Direct Connect Endpoint Client (DCEP), or who do not have an Endpoint client installed on the system in question.


Recommended next steps:
Currently there are no additional mitigation steps that can be offered by Forcepoint, aside from removal of the Microsoft Office App.  Per Microsoft, this app is not required software and will not impact actual Office suite functionality in any way.  This is the current recommendation from both Forcepoint and Microsoft, per development's discussions with Microsoft on the issue.
We recommend that each customer approach Microsoft support to create a ticket and have the issue investigated. Additional reports of the same issue may highlight its severity within Microsoft.

Here is the latest update from Microsoft vendor as on Jan 22nd 2019, "Team is still looking into the root cause of the problem, but in the meantime, we are pushing out an update to "Office Hub" that will bypass the proxy calls and not reset the proxy settings. This is basically a stop-gap until they can get to the bottom of the actual problem. Also there will be no requirement to update Windows manually. The fix is now available in Insider rings for Windows and will be generally available in the next week or so."


Here is the Microsoft ticket number so that you can reference it when reaching out to them about this issue: 119121023002564

 

Article Feedback



Thank you for the feedback and comments.