Endpoint Protection

Hi

I have just rolled out Symantec Endpoint Protection 11 to my firm.  One problem we now have is that our encrypted USB sticks are now longer able to run.  When you insert the stick an exe on the drive should run and you then enter a password to access the contents.  Due to the security on USB sticks this is no longer possible.

My question is, am I able to exclude the SafeStick.exe file from being blocked for all sticks?  We have over 30.

Thanks

James

follow this doc to allow safestick

http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/b54beb2f46268ccc882574e80052960f?OpenDocument

UPDATE

I have added SafeStick.exe to the exclusion list which has worked.  I would however like to add the file fingerprint just in case a trojan or similar ever has this name.  How do I use the checksum tool?  

I tried checksum.exe c:\SafeStick.exe results.txt and I just get 

followed the same steps

Generating the file fingerprint list:

• • Open a command prompt window.
  • Navigate to the directory that contains the file checksum.exe. By default, this file is located in the following location: C:\Program Files\Symantec\Symantec Endpoint Protection
  • Type the following command: checksum.exe outputfile drive
    • where outputfile is the name of the text file that contains the checksums for all the executables that are located on the specified drive. The output file is a text file (outputfile.txt).

• • The following is an example of the syntax you use: checksum.exe cdrive.txt c:\
    •  
    • http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/7049d06ba3c9e86f802573620054d9c2?OpenDocument
  •  

You can find some websites also which will help you to find the fingerprint of a file..

This is all working now but I have had to stop using parts of the policy as I can't add EVERY exe file to a separate line in the policy.  I have submitted a change request to get Symantec to allow referencing of the file fingerprint lists instead.  Let's hope...

Hi,

We would like to roll out an USB stick encryption software on all of our USB memory sticks. We have various types of the USB memory sticks in use. We want to block all of the USB memory sticks which does not have the encryption software and which is not an authorised USB memory stick.

Can we enter a device id for each of them in SEP (to unblock the usb memory stick) and unblock the encryption software (for example safestick.exe) via application control in SEP?

On an existing memory stick (used for about a year or 2), where can we find a device id?

Many thanks

I would personally use a Device ID with a wild card (*) to get this going, and have done so successfully with Iron Key devices already.

I have a policy with all USB devices disabled, except for the Iron Key devices in use.  There are a number of articles available to help you get this going.