McAfee whitelist epolicy 5.3.1

[chooyq]

Hi all, I have a customer operating on McAfee epolicy 5.3.1. Previously I have no issues when it comes to whitelisting of external storage media. However, recently I have encounter a issue. After I whitelisted a device, I am still not able to use the device. Am I missing out something?

[catdaddy]

Discussion successfully moved from ePolicy Orchestrator (ePO) to Data Loss Prevention (DLP)

For better exposure and better assistance.

[frank_enser]

Hi,

which point product? I assume Device Control/Data Loss Prevention Host?

Regards,

Frank

[catdaddy]

Should this be moved to that area?

[frank_enser]

Wait for confirmation from chooyq, what pp is used.

[catdaddy]

Thank you Frank.

[chooyq]

Hi Frank, what do you mean by pp?

[tonyw]

pp = point product.  In this case it was assumed to be DLPe.

[moekhass]

​, it sounds like you need to review your policy. you need to open the DLP console on workstation OR look at ePO events when you connect the device. Review the details of that event, what is the unique attribute you can find about that particular device? is the serial number visible? If so, I would add exceptions for that serial number in your policy. Here's a screenshot from DLPe 10. So I have a general umbrella policy where I block usb devices using "USB Block" rule. But I also have some exceptions. The block rule basically states that block everything that are NOT on "USB Allowed" list. Hope that makes sense.