Endpoint Protection Small Business Edition

 Hi! I am kind of stuck on something and need any advice that can be given. What I want to do is create a policy in SEP management console that disables the use of thumbdrives on workstations, but if any other thumbdrive or any other usb device is needed for a legitimate reason then the IT department can key in the admin password so the user will have access to the device. This will increase security so not just anyone can walk in plug in a thumbdrive that has God knows what on it, but there still needs to be a way for users to access usb devices when approved by the IT department. I am not sure if there is even a way to do this and before calling Symantec I want to see if any of you have any info. If I go into SEP management console and disble USB devices this even disable the use of the keyboard, which will not work. Maybe there is a more granular way to set this up?

there is no way currently where you type in the password for enabling the USB temporary or permanently. You can whitelist few USB from blocking,

Check this article for enabling or disabling USB

https://www-secure.symantec.com/connect/articles/how-block-or-allow-devices-symantec-endpoint-protection

As per my understanding you want to set the password to enable the USB access of User end..

To set the password

Go to SEPM.

Login Console with Admin Id.

Go client Tab and then choose the Group where you want to set the password.

Under that Group choose the policy TAB.

Click on General Setting then tab on Security Setting.

There four option avail

Check the "Require a password to stop the client service"

Enter the passwor that have mention on right hand side of the security tab.

Then ok and then right click on that Group and update the conent.

It will set the passwor to stop the SEP.(command smc -stop)

If you need to block all USB policy excep Human Interface(keyboard/mouse)

Pls follow the attach document..

Attachment(s)

How to block USB devices while excluding mouse and keyboa...docx   13 KB 1 version

Hello,

I agree with Pete.

At present there is no such way at present in SEP.

However, in your case what you could do is:

Let the employee who requires such permission or such access, let them send the Administrator an email and simply what the administrator could do is move the SEP client within SEPM from one group to another which do have access granted.

Simple...!!!

 Thanks for the info!