Endpoint Protection

Hi guys, I've seen numerous posts on the forums regarding this subject and saying that it's not possible, well it can be done with the aid of a small 3rd party utility installed on the client.

I think the issue has occured due to some changes in the way the iPhone and other devices communicates and presents itself to Windows, it used to work and now it doesn't.

Anyway I'll cut to the chase, if you install a utility that boosts the voltage output at the USB port (I used ASUS AI Charger) you can simply block the entire smartphone class ID with device control and with this utility running the phone still charges. :)

And you can confirm this works with the blocking policy in place?

On SEP 12.1 this allows me to block access to the phone via explorer, I then use application control to prevent iTunes launching and the iPhone charges, both 4s and 5 seem to work fine.

What happens when using device control to block USB? Does it block USB but allow charging?

I don't want to block all USB drives so using Dev viewer I put in the device or class ID of the phones....All removable storage needs to be read only, so I do that with app control.

I haven't tested with all USB blocked as that doesn't fit my use case, sorry.

No biggie, was just curious. I believe most here want to block USBs but allow charging.

Hi guys,

But, just with a 3rd party? The perfect world would be using SEP to block all phones and allow just charging...

Ladsbroke maybe you can share your policy with us?

OK so a quick update, I thought I'd test with all USB (Class ID) blocked in place of the smartphone in the DC element of this policy and no luck.

So what I have deployed is as follows Device control blocking the Smartphone class ID, application control making removable storage read only and also blocking iTunes.

With this policy in place there is no visibility of the iPhone 4S or 5 and both phones continue to charge.

All this from installing a 3rd party utility on the client which increases the voltage to the USB port. Without this utility and with the same policy applied the phones do not charge.

It does what I need it to do, so I thought I'd share...and before you guys ask I have made the Product Managment Team aware of this.

Question. 

Using SEP 12.1.4 (device Control feature); is there a way to enable an alert or log which alerts the SEP admin when an iphone device has connected to a system running Windows 7?  If so, how is this accomplished and where can the log file(s) be located?  Thanks in advice for your assistance. 

Not when connected but only if something is actioned (ex. files read, copied, deleted.)