Video Screencast Help

Application/Device Control and Granular Optical Drive Control

Created: 04 Feb 2014 • Updated: 04 Feb 2014 | 4 comments
jcrawford2009's picture
This issue has been solved. See solution.

Good morning! 

I was asked a question about SEP's device control that I found myself unable to answer, therefore, if anyone has any further information on the subject or links to an article, that would be great, since I have not found anything on this particular problem. 

Let's say that SEP is installed on endpoints within an organization who heavily depends on disk drives for reading information. Now, the system administrator has had problems with confidential information leaving the organization after being burned onto compact disk. 

Does SEP provide any type of optical drive control setting which would allow for the employees to READ information from the optical drive, but prohibit WRITE functions? Again, this is relating to the hardware itself, not the software which writes disks, so I am not asking about whether SEP can block CD burning applications (Nero, etc), but rather if SEP can restrict the optical drive itself from writing to optical media, while allowing for media to be read from the drive. 

Thanks for your thoughts and have a great day! 

Operating Systems:

Comments 4 CommentsJump to latest comment

ᗺrian's picture

You can only block or allow the device via device control

However, have a read thru this:

How to block USB hard drives in SEP, but allow reading specific USB drives in the SEPM Application and Device Control Policy

Please click the "Mark as solution" link at bottom left on the post that best answers your question. This will benefit admins looking for a solution to the same problem.

SMLatCST's picture

So in a nutshell, no.

SEP does not have any ability to block writing only at a hardware level.  As Rafeeq has linked, the only way currently to block writes but allow reads, is to block access to the native Windows IMAPI drivers.

Unfortunately doing so does not necessarily stop other applications from writing to optical media, which means to block writes but allow reads, you may end up with a huge list of blocked disk-writing applications sad