I have two DLP polices setup, one to block usb devices (excluding domain admins) and the other to warn when a usb device is plugged in.
I created an EPO warning policy for DLP Computer Group Assignment and selected only the usb warning rule
I created a Warning group in the EPO system tree and assigned the EPO warning policy to that group. I moved computers to this group.
I created a second Block group and left the default policy assignment, I moved different computers to this group.
I verified on the destination warning computer that the correct DLP policy, endpoint configuration and Computer assignment group is applied.
When I plug a usb device into this computer the device is blocked if not a domain admin. It should only be receiving the warning rule no matter who is logged on.
What am I missing?