We are running into a strange issue. We have a monitoring policy to make Removable Storage Devices read only. When we insert the device we do get a popup saying that the device will be monitored. But we can write to the device without any issues. If we format the device while its plugged in and then try to write something to it, we get blocked. The USB device is a Sandisk Cruzer. Has anyone seen this behavior
I believe that the Sandisk Cruzer have a software installed, maybe DLP is bypassing this software.
Other thing you can do Its to create a block all rule, and then create the monitor rule to specific User groups, that has worked for me...