Issues excluding Smartphones for storage file access

[Linuxxo]

Hello,

I have created a P&P rule that block access to all smartphones as storage device and that is working as expected, however I am having issues when I attempt to excluding some smartphones. I have tested the feature before and I am sure that it was working, but I am trying again now and it seems to have stopped. What I have done:

- Create a Plug and Play Device entry through the Incident triggered by the blocked smartphone
- Selected the smartphone on the Excluded listed and enabled it
- Apply the policy on the ePo and update the DLP Endpoint
- Plug in the smartphone that should be excluded, but the device is still being blocked

Am I doing something wrong? Or, is there a chance that the rule may have become corrupted?

Many thanks in advance.

[DLP_RS]

As you might be seeing it within rule configuration settings, we can have the exceptions based on the below settings.

Excluded Device Templates
Excluded Serial Number & User Pairs (Disabled)
Excluded Users

First please check, if any of the above options work as an exception. If none works, then certainly we need to further troubleshoot the issue.

[Linuxxo]

Thanks for your suggestions. I have tested the Excluded Users option and that works fine. But the Excluded Device Template with the P&P Device exclusion created through the Incident is still not working. I have already tried to create a new rule, new policy and even reinstalled the DLP Endpoint agent.

[DLP_RS]

So it has been narrowed down to Device Template.

What happens if we create another rule using same Device template? Does it trigger for the same PnP Device? Make sure to disable the earlier rule.

[Linuxxo]

Tested all that, even tested with using a different smartphone, same issue. The device template created through the Incident is not being excluded. However if I do exclude the user, then it works perfectly fine. I am really puzzled because the same option that excludes devices, used to work just fine.

[DLP_RS]

Is it okay if you can share the screenshot of the Incident generated and exception created using the same for review?

[Linuxxo]

As requested, a copy of the Incident and how the Device template is created.

[DLP_RS]

I would suggest to use minimal device properties and then add rest of the properties one by one to know which one is a mismatch.

For example, lets start by using Device Description and Bus Type.

[Linuxxo]

Thanks for the suggestion. I have already tried to create the Device template using the Device Instance ID and that gave an unexpected result. Access to the Device was blocked until I selected the PTP option on the smartphone, which then gave me full access to the device as storage. I will now try your suggestions and see what happens.