I want to be able to store all files being copied to an iPad to be stored as evidence.
I created a Device Definition Rule for Windows Portable Devices and Removable storage devices to monitor all iPad by PID and VID.
I created a File Access Protection Rule to track the application "iTunes" and monitor, notify and store in Evidence for the iPad User Group.
I created a Removable Storage Access Protection Rule when writing to "Explorer" and monitor and notify for the iPad User Group.
This works some of the time but not consistently. Any suggestions?
Thanks in advance for your time.
You need to create a Protection Rule and apply it to users that have authorized iPads...set it to Monitor Only and "Store Evidence".
I see your post is old, but did you figure this out?