Data Loss Prevention

Has anyone run into a problem with an endpoint becoming un-usable after the removable storage monitoring is enabled and yet the endpoint does not have an eSata, Firewire or USB device connected to it?

I am running DLP 11.6 and the endpoints are configured with Windows 7 SP1 64-bit with Truecrypt FDE. Also only 6 out of 150 endpoints experienced the problem.

I redeployed the agent configuration with removable storage unchecked and the endpoint returned to normal.

best way is to open a support ticket.

Michael,

Check and see if the hard drive is filling up on these endpoints. There is a known issue for the 11.6.3 and 12.0.1 agents where if HTTPS is enabled with IE, it will fill up the HD.

Also for those 6 agents, what are they doing. Is there a similar application ar use that they have? It also might be that those 6 agents are showing the HD as a USB device and as a result are inspecting every write to the drive. Since you have the removable storage turned on.

You should run the DeviceID application (Endpoint Tools folder) and run it on those agents. See if the local drive is actually considered an USB device.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak

Please check policies applied at endpoints and endpoint exception (removable storage)

If you uncheck the HTTPS for IE.. won't that make it so Endpoint no longer scans HTTPS pages?

Zach..

Yes if you do uncheck the HTTPS it will stop inspecting HTTPS. Though this is a test to see if this is the issue. There is a HOTFIX release that already fixes this issue.

Support has already released a hotfix for the HTTPS issue.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak