Anyone had any similar issues?
Are these drives from one vendor? It could be that that they're not classed as USB but WPD devices. In that case you can block them as WPD.
To test setup a PnP rule for WPD (Device Class = Windows Portable Device) and nothing else - assign to your end-user group etc and enable.
Once the policy is updated on the test endpoint plugin the drive. Does that work? If so you can block it using that WPD definition.
If not please obtain the device info from Incident Manager and post it here - there's (nearly) always a way to block things.
Thanks for the reply
I have created a WPD rule, I have tried with a segate and Samsung drive I do get the pop up notification saying it was blocked but i can still open the drive
2 of 2 people found this helpful
It is a Seagate Backup Plus or something similar? If so it could be a USB-Attached SCSI (UAS) which will have the symptom you described. If that's the case you'll need 10 patch 2 as I believe that'll fix it.
Try logging a case for pre-release P2 or wait till it's release.
Ok thanks Chris I'll check and also try get info from incident manager
1 of 1 people found this helpful
Might look at https://community.mcafee.com/thread/91100?start=0&tstart=0 ar4niner has something similar.
I just came across this myself and still searching for a solution, looks like a newer drive I have is detected as a SCSI on the Win10 systems and doesn't trip the rule set. On win7 however the drive is blocked as expected.
thanks for the reply back, looks like it may be the issue but I am unable to choose the SCSI and Raid Controllers rule trying to change the device class status to "managed"
I didn't try any of the stuff on the other thread, was to worried about the possible unintended results, once I saw chrisnlc post we decided to just hold tight and see what the patch does for us. I'm working on setting up some logging for all SCSI drives so we will at least see if one gets attached until then.
Question for you, in my searching I realized it looks like this USB-Attached SCSI (UAS) issue has been around a while? seeing references to it in DLP9. Are there any true indicators that its being addressed in an upcoming patch for 10? I was unfortunate enough to have someone in management witness DLP's epic fail to block an external drive after I spent the last 20min telling them how awesome it was. /sheepish