Endpoint Protection

 View Only
Expand all | Collapse all

Issue with App. & Device control in ver. 11

  • 1.  Issue with App. & Device control in ver. 11

    Posted Apr 29, 2009 07:44 AM
    Hi

    I am currently blocking Bluetooth Devices ( generic ) in my BT Block Policy, But i want some products to be "white-listed" but cant get it to work.

    CLASS ID for BT Devices Generic is : {95C7A0A0-3094-11D7-A202-00508B9D7D5A}  and is BLOCKED

    Device ID for T400 BT modem : {95C7A0A0-3094-11D7-A202-00508B9D7D5A}\WCBTMODEM0\1&30EE4AD&0&1000000040001 and is set to be ALLOWED

    Device ID for Nokia E71 BT modem : 7EFA569549814b2f8D267B9A5F21BA0F_RM_346 ALSO ALLOWED.

    I  tried to block the E71 device .. but same luck as allowing... nothing happneds....
    and i cannot "unlock" the T400 BT modem as long as Generic BT modem is blocked... even if i ALLOW the specific device ID for the BT modem in T400...


    Can any1 please help me with some wise words here...




  • 2.  RE: Issue with App. & Device control in ver. 11

    Posted Apr 29, 2009 08:11 AM
    You shuold try to use the DevViewer.exe shipped with the SEP installation media (CD2 Tools\NoSupport\DevViewer\).
    This program ideal for App & Device control. You can copy the GUID or the Device ID to clipboard.
    My problems were solved this way.


    Best regards,

    DoubleE



  • 3.  RE: Issue with App. & Device control in ver. 11

    Posted Apr 29, 2009 08:23 AM
    Am using the DevViewer ...
    Super tool...

    Got irritated and confussed by ordinary dev. manager ...

    but Dev.Viewer helped me some way ... but not whit this issue


  • 4.  RE: Issue with App. & Device control in ver. 11

    Posted Apr 29, 2009 11:49 AM
    Can you post a screen shot of your Device Control page?

    My current problem is blocking Wireless cards at the device level. For some damn reason, there is only one large class of Network Adapters making no distintion between Wireless and Wired. I can make a block at the firewall level, but its not as good as the device blocking. That basically forces us to block every single wireless card device ID :-( Any idea on that?


  • 5.  RE: Issue with App. & Device control in ver. 11

    Posted Apr 29, 2009 12:41 PM
    "Device ID for T400 BT modem : {95C7A0A0-3094-11D7-A202-00508B9D7D5A}\WCBTMODEM0\1&30EE4AD&0&1000000040001 and is set to be ALLOWED"

    The entire Device ID is specific to the computer where you're viewing it so you'll have to wildcard it.

    Try putting an * after the \ instead of all the characters and see what happens.

    Yours looks odder than mine but try WCBTMODEM0\* and see if it works.

    Ray



  • 6.  RE: Issue with App. & Device control in ver. 11

    Posted Apr 30, 2009 03:03 AM
    Somoething i dont understand is that even if i Block the default policy ( Bluetooth devices Generic ) it doesnt block the 2 mobilephones that im testing with ...
    Very odd..

    and if i should wildcard them it would be on BT modem channel base... and i could hit the ones active...
    ill fire up the gear l8r and take a Dump and post it here.


  • 7.  RE: Issue with App. & Device control in ver. 11

    Posted Apr 30, 2009 04:11 AM
    tried the wildcard thing on BT modem ... Went well... untill BT Device Generic policy Disabled them again... so now it enables / disables.. ROFL..

    here is a screendump of dev. man.
    wanna allow BT modem and block the 2 mobiles.

    imagebrowser image


  • 8.  RE: Issue with App. & Device control in ver. 11

    Posted Apr 30, 2009 10:41 AM

    The are Bluetooth Radios and Bluetooth Devices. Are you blocking both Class IDs?

    Ray



  • 9.  RE: Issue with App. & Device control in ver. 11

    Posted May 01, 2009 04:28 AM
    is that wrong ???...

    wanted to prevent access from other types of Bluetooth than the one i have "white listed" / excluded from block ..

    so i can control the bluetooth access to the laptops.


  • 10.  RE: Issue with App. & Device control in ver. 11

    Posted May 01, 2009 08:26 AM
    I just wanted to make sure you were blocking both. You may have to open a case with Symantec directly.

    Ray