Endpoint Protection

We run a fleet of Dell 990,960 and 755 computers. Recently we have been piloting Device Control for management of USB devices but I have come across a few issues. When I block USB devices but exclude HID devices from blocking if you unplug the keyboard and attempt to plug another on in the new keyboard will be blocked. I have also see that when you plug the origional keyboard back in that it will nolonger work. In one case I spent over an hour attempting to re enable the keyboard but in the end I moved the computer back to a policy that did not contain Device Control.

The issue seams to stem around the USB Hub in the computer so as a logical step I added the USB Hub to the exclude from blocking list. What I then found was that this enabled all down stream devices even if they were in the blocked list. So if I plugged in a usb key this device was active.

My plan at this point is to specifically exclude all keyboards from blocking using the device id with a wildcard after the product section and to remove the USB Hub from the exclusion list (unless anyone has a better solution for this issue).

We are using version 11.0.6005.562 on an XP sp3 desktop.

I did see a note which refered to this issue being fixed in SEP 12.1 but we are hoping that a simpler solution is avaliable. 

Instaed of using device ID to exclude those keyboards..check excluding using class ID i.e guid

The exclusion for HID's is currently the inbuild class {745a17a0-74d3-11d0-b6fe-00a0c90f57da}.

Then please check..whether the policies are correctly updated in those machines..

Policy is correctly update on these computers. The release notes for SEP 12.1 imply that this was an issue with previous versions. The following is listed under product changes in this release.

Application and Device Control will incorrectly block a USB device when connected for the first time
Fix ID: 1284681
Symptom: USB hub devices are incorrectly blocked and devices attached to the hub are not recognized.
Solution: USB hub devices are no longer blocked by default.  SEP only blocks child devices of USB hubs.  If the Application and Device Control policy is specifically configured to block the USB hub, all child devices are also blocked.

http://www.symantec.com/business/support/index?page=content&id=TECH174565

It is only an assumption that adding the manifacture and product to the excludion list will resolve this issue but it has to be better than migration to 12.1.

But migrating to 12.1 makes u and ur envitornment very secure.

The issue with migrating to 12.1 is that it would take some time and alot of resources to get to that point, this would include a full test cycle of all functionallity. SEP 11 is meant to be able to carry out this functionality but appears to have some issues.  

bonjour, je veux savoir  comment bloquer l'importation ou

 l'export des fichiers apartir d'un disque amovible dans un systeme avid, merci pour votre aide

Kindl find the attach pdf.

Attachment(s)

Application and Device Control_V1 2_2.pdf   1.82 MB 1 version

You may want to log this as a seperate thread.

I have ammended the USB hub from a guid to a device USB\VID_8087&PID_0024\* . I have added device ID's for several of the vendor keyboards with a wild card for the serial and a ?? for the second half of the model/PID. a couple of examples are below.

USB\VID_413C&PID_10??\*

USB\VID_413C&PID_20??\*

USB\VID_413C&PID_21??\*