Endpoint Protection

I need help finding a solution. I am using SEP and device control to block USB Storage Devices. I have several thousand USB Storage devices that I would like to allow and the vendor ID is the same, but the device ID is unique to each device. I would like to know how to use wildcard charatcers to allow any USB device from that vendor instead of having to whitelist each individual device.

 

Thanks

If you look in the Device Control policy you will see a list of names already.

You can use the wildcard *

So for example USB Storage just use USBSTOR*

The * will block anything with USBSTOR and any characters following it.

You can use DevViewer to get the hardware IDs

How to obtain Disk Drive Device ID's from hardware that fails to show in the DevViewer Tool

Article:TECH140485

|

Created: 2010-09-22

|

Updated: 2010-09-22

|

Article URL http://www.symantec.com/docs/TECH140485

 

I need to be able to block all usb storage devices except for one type from a specific vendor. I have several thousand of these devices from the same venodr so it is not possible for me to include the entrie device ID. Also, I have had no luck using * wildcard charaterl in the policy.. any other suggestions?

Did you try adding USBSTOR* under Blocked Devices and than adding the one you want to allow under the Devices Excluded from Blocking. If it is the same type, the device ID should be the same

HI You can try

Put this 

USBSTOR\DISK*

 

========================

 

Kindly find the attach document "Application and Device Control.pdf"

Find the below snap where it define that how to create the policy using asterik(*) sign

I appreciate the info and research. I'll post the results.

We are waiting for the result. Incase any other help require then please reply.

If your issue will resolve with above comments then please mark the answer on resolution comments. So it can help to others.

 

We have not recieved any revert on same from long time, hopefully your query has been closed. If your issue closed then please mark valid comment as a solution which can help to other.

Thanks