Fix: Loom “Screen Recording” blocked by Corporate Security (DLP)

When a corporate Data Loss Prevention (DLP) or endpoint security policy blocks Loom, your screen recording produces a solid black window, displays an explicit security overlay, or halts immediately with an alert such as “Screen capture blocked by organization policy.” This block occurs when enterprise security software—such as Netskope, Zscaler, CrowdStrike, Microsoft Purview, or Symantec DLP—restricts applications from capturing sensitive display pixels, transmitting streaming video outbound, or hooking into native operating system graphics APIs.

Fast Fix

Determine whether the block is application-specific by minimizing confidential software (such as banking portals, CRM tools, or Outlook) and recording a basic desktop application like Notepad. If recording works, your DLP policy is window-specific. If the entire screen is blocked, switch between the Loom desktop app and the Chrome extension, as corporate endpoint policies frequently authorize one client while restricting the other.

---

Diagnostic Snapshot

Parameter	Operational Detail
Failure Layer	Endpoint DLP agent, Secure Web Gateway (SWG), or OS kernel display hooks
Common Symptoms	Black screen recordings, “Action Prohibited” popups, extension permissions greyed out
Common Agents	Netskope, Zscaler, CrowdStrike Falcon, Trellix, Microsoft Purview DLP
Resolution Authority	Enterprise IT / Information Security (InfoSec) administrator

---

Diagnostic Path: Identifying the Security Enforcement Layer

Follow this sequence to diagnose whether your recording failure is caused by an endpoint agent, a browser policy, or application-level pixel protection:

Screen capture fails or displays a black feed
       │
       ├──> Does the screen turn black only when a specific work tool is on screen?
       │      └── YES: Application-level DRM or window-level DLP flag (e.g., Salesforce, banking).
       │
       ├──> Does the capture fail across every app on the Loom Desktop Client?
       │      └── YES: OS-level kernel hook or endpoint agent (CrowdStrike/Netskope/Purview).
       │
       └──> Does the failure occur only inside Google Chrome / Microsoft Edge?
              └── YES: Managed browser policy (Chrome Enterprise policy: ScreenCaptureAllowed = false).

1. Window-Level vs. Desktop-Level Blocking: Modern DLP tools use application-level protection. The agent lets Loom record your operating system, but the moment a window marked “Confidential” (such as customer health records, payment systems, or proprietary code repositories) enters the frame, the driver blacks out that specific window or the entire canvas.
2. Managed Browser Policies: Corporate Google Workspace or Microsoft Entra environments often apply Group Policy Objects (GPOs) or Chrome Enterprise policies that disable browser-level screen capture APIs (getDisplayMedia) to prevent data leakage. If your browser extension crashes or fails under these policies, review How to Resolve: Loom “Chrome Extension” crashing during Capture.
3. Outbound Data Exfiltration Rules: Some network firewalls allow the recording to start locally but terminate the connection when Loom streams chunked video packets to Amazon S3 buckets. If authentication drops or loops during this handshake, see Fix: Loom “SSO” sign-in loop for Enterprise accounts.

---

Step-by-Step Resolution

Step 1: Isolate Application-Specific DRM and Protected Content

If an individual window contains protected data, the graphics driver prevents third-party software from reading its buffer:

1. Close all enterprise software containing customer data, financial systems, or corporate email.
2. Open a plain text editor (like TextEdit or Notepad) or a blank browser tab.
3. Start a test recording using Loom.
4. If the test records clearly without a black screen, your corporate DLP policy specifically restricts recording those protected enterprise tools.
5. Workaround: Record using Window Capture instead of Full Screen, selecting only the approved non-confidential application window you need to present.

Step 2: Compare Desktop App vs. Browser Extension

Organizations often enforce security rules differently across native binaries and browser add-ons:

• If the Desktop App is Blocked:
  Endpoint agents often block unauthorized .exe or .app binaries from accessing screen capture frameworks. Try recording with the official Loom Chrome Extension, as browser extensions operate inside the browser’s approved network sandbox.
• If the Chrome Extension is Blocked:
  System administrators frequently lock down the Chrome Web Store or disable the screen-capture API across managed browser profiles. Download and install the dedicated Loom Desktop App, which routes capture requests through native OS media drivers rather than the browser sandbox. If the desktop client stalls while launching, consult Fix: Loom “Desktop App” stuck on “Initializing”.

Scenario A: Desktop Binary Blocked by DLP Agent ──► Switch to Chrome Extension (Allowed in Sandbox)
Scenario B: Browser API Locked by Chrome Policy ──► Switch to Desktop App (Bypasses Browser Restrictions)

Step 3: Check Local Operating System Security Flags

Make sure standard operating system privacy permissions have not been blocked by an enterprise configuration profile:

• On macOS:
  1. Open System Settings > Privacy & Security > Screen & System Audio Recording.
  2. If the toggle for Loom is greyed out with a lock icon, your computer has an MDM configuration profile (such as Jamf or Kandji) enforcing a screen recording ban.

1. Open System Settings > Privacy & Security > Screen & System Audio Recording.
2. If the toggle for Loom is greyed out with a lock icon, your computer has an MDM configuration profile (such as Jamf or Kandji) enforcing a screen recording ban.

• On Windows:
  1. Check your system tray for security agents like Netskope Client, Zscaler, or Trellix.
  2. Right-click the agent icon to check connection status. If the agent displays a recent “DLP Policy Event,” note the timestamp and policy rule name for your IT support ticket.

1. Check your system tray for security agents like Netskope Client, Zscaler, or Trellix.
2. Right-click the agent icon to check connection status. If the agent displays a recent “DLP Policy Event,” note the timestamp and policy rule name for your IT support ticket.

Step 4: Validate Shared Link Security Settings

If corporate security permits screen recording but blocks external sharing, your links may fail when sent to outside clients. If recipients cannot open your recorded videos due to security wrappers, review Fix: Loom “Password Protected” links returning Access Denied.

---

IT and InfoSec Escalation: Required Allowlisting Details

If corporate policy prevents all screen recording and you need Loom for your daily workflow, you must submit an exception request to your IT or Information Security department. Provide them with the following technical specifications:

• Application Binary Paths:
  • Windows: %LOCALAPPDATA%\Programs\Loom\Loom.exe
  • macOS: /Applications/Loom.app (Bundle ID: com.loom.desktop)
• Windows: %LOCALAPPDATA%\Programs\Loom\Loom.exe
• macOS: /Applications/Loom.app (Bundle ID: com.loom.desktop)
• Required Network Endpoints (Ports 443 outbound for HTTPS and WebSockets):
  • .loom.com
  • loomcdn.com
  • Amazon S3 multi-part upload buckets: .s3.amazonaws.com
• .loom.com
• loomcdn.com
• Amazon S3 multi-part upload buckets: .s3.amazonaws.com
• Chrome Enterprise Policy Adjustment:
  If the browser extension is required, request that IT add liecbddmkiiihnedobmlmillhodjkdmb (Loom Chrome Extension ID) to the ExtensionInstallAllowlist and verify that the ScreenCaptureAllowed policy is not set to globally block the corporate domain.