Device Control - Device ID Wildcard not working?

Created: 22 Oct 2012 | 8 comments

huntmknox

Hi all,

I have device control policies running and it's working fine.
I blocked USB to block thumbdrives and created exceptions for USB printers, Keyboard etc.

I created my own exception to allow Apple devices but it doesn't seem to work using wildcards. It does work when I use the full Device ID.

This is the device ID of an iPhone 4S: USB\VID_05AC&PID_12A0\A2BDCF4999324F6DA69FD82943989926FC5274EE

When I create an exception to allow all Apple USB devices with this ID: USB\VID_05AC* it does not apply.
I also tried the following:

USB\VID_05AC
USB\VID_05AC&*
\USB\VID_05AC
\USB\VID_05AC*
"\USB\VID_05AC*"

Version is 12.1.671.4971

Here is an example of the security logs:

Using wildcards:
Device Manager Message
The device was disabled successfully.
[name]:Apple Mobile Device USB Driver
[class]:Universal Serial Bus controllers
[guid]:36fc9e60-c465-11cf-8056-444553540000
[deviceID]:USB\VID_05AC&PID_12A0\A2BDCF4999324F6DA69FD82943989926FC5274EE

Device Manager Message
The device was disabled successfully.
[name]:Apple iPhone
[class]:Portable Devices
[guid]:eec5ad98-8080-425f-922a-dabf3de3f69a
[deviceID]:USB\VID_05AC&PID_12A0&MI_00\0

Using the complete Device ID:

Device Manager Message
The device was allowed successfully.
[name]:Apple Mobile Device USB Driver
[class]:Universal Serial Bus controllers
[guid]:36fc9e60-c465-11cf-8056-444553540000
[deviceID]:USB\VID_05AC&PID_12A0\A2BDCF4999324F6DA69FD82943989926FC5274EE

Device Manager Message
The device was allowed successfully.
[name]:Apple iPhone
[class]:Portable Devices
[guid]:eec5ad98-8080-425f-922a-dabf3de3f69a
[deviceID]:USB\VID_05AC&PID_12A0&MI_00\0

Anyone have any ideas how to get this working?

Discussion Filed Under:

Security, Endpoint Protection (AntiVirus) - 12.x, Endpoint Protection (AntiVirus), Security Risks, Troubleshooting

Comments RSS Feed

Comments 8 Comments • Jump to latest comment

Brian81 Trusted Advisor

Device Control - Device ID Wildcard not working? - Comment:22 Oct 2012 : Link

Have a look at this taken from admin guide:

For Device ID we also we support the use of wildcards "*" and "?":
• Asterisk (*) means zero or more of any character
• Question mark (?) means a single character of any value
Examples:
• Any USB storage device: USBSTOR*
• Any USB disk: USBSTOR\DISK*
• Any USB SanDisk drive: USBSTOR\DISK&VEN_SANDISK*
• Specific SanDisk device:
USBSTOR\DISK&VEN_SANDISK&PROD_CRUZER_MICRO&REV_2033\0002071406&0
• Specific Kingston device: USBSTOR\DISK&VEN_KINGSTON&PROD_DTSECURE_PRIVACY*

SEP Knowledge Base

Endpoint SWAT