Fixed Hard Drive rules do not apply for boot\system partition
We have created a monitor rule for fixed hard drives.
one of our users has plugged a SATA Hard Drive from his old computer to his new computer, no alert was created on DLP Endpoint.
I read the DLP 11.4 Product guide and it says:
"Fixed hard drive rules do not protect the boot or system partition."
My guess is that DLP Endpoint did not alert for this new HD because it has a System\Boot partition since it was the primary HD of an older computer.
So first of all- does my conclusion make sense? and if so, then how can we monitor for such cases that someone connects a secondary HD with System\Boot partition?
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.