Video Screencast Help
Protect Your POS Environment Against Retail Data Breaches. Learn More.

internal drives disabling after blocking USb

Created: 31 Oct 2013 | 12 comments

Hi,
I blocked USB drives with device control policy.but after blocking USB drives, system local/internal drives like D drive also disabling/disappearing . In that group , 100 systems are there . All are showing same thing. SEPM Version is 12.1.2.

By default all those drives are logical drives. Please suggest on this.

Regards
Santhosh

Operating Systems:

Comments 12 CommentsJump to latest comment

SMLatCST's picture

How are you doing the blocking?  It sounds as if you're blocking either the "Storage Volumes" or "Disk Drives" class, in which case this is expected behaviour.

You might have better luck creating a Hardware Device with the below Device ID and blocking that instead:

USBSTOR\*

Rafeeq's picture

try this method

How to block USB Thumb Drives and USB Hard Drives, but allow specific USB Drives in the Application and Device Control Policy in Symantec Endpoint Protection.

 

http://www.symantec.com/business/support/index?page=content&id=TECH106304

SameerU's picture

Hi

Whether these drives are logical drives

Regards

 

SanthoshReddy K's picture

Yes. These are logical drives. Hp systems inbuilt os with one drive came by default. We created/shrink one more drive.

Please suggest on this.

SanthoshReddy K's picture

We are using symantec EP v12.1.2 

We are facing some issues in blocking the USB devices , if we block storage volumes in blocked device in device control policy, all the users using symantec clients blocks the internal disk drive (example D:/ ,E:/ but it excluding C:/ drive ...

Our requirement is to block the USB drives and external hard disk..

 

 

SameerU's picture

Hi

Put USB in block list and put Storage volumes in exclusion list

Sometimes in SEP 12.1.2 it detectes other drives i.e D: and E: as logical drives which are detected in SEP 12.1.2 as USB

Regards

 

SameerU's picture

Hi

Can you please update on the provided solution

Regards

 

SMLatCST's picture

Can you tell us what you've tried so far?  For instance, have you tested out replacing the "Storage Volumes" block with the device ID (USBSTOR\*) block I mention in my first post?

Alternative options:

  • Replace "Storage Volumes" block with "Disk Drives" block
  • As it is a standard HP build, find the Device ID of the logical disks using DevViewer and add appropriate exclusions
SameerU's picture

Hi

Can you please update on the solution provided

Regards

 

SanthoshReddy K's picture

I tried to give exclusion with device Id. But still issue is not solved.

 

Planning to Upgrade to 12.1.4..

joash theory's picture

Any solutions to this? im experiencing the same issue.