I'm trying to create a protection rule to notify and store evidence whenever a user copies a file to any pendrive, external HDD or a cell phone.
I've created the protection rule including explorer.exe in application definition, included all file types being copied, selected "store evidence", "notify user" and "monitor" as an action, and the user assignment group that has the test user with write and read permissions.
when the user copies or moves a file to a pendrive i can't see any of the actions being performed, am i missing something?
We are currently using DLP 9.3.300.16 and windows 7
Thanks in advance