Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
1187 Views 6 Replies Latest reply: Jan 10, 2014 10:53 AM by Scott Sadlocha RSS
vveijie Newcomer 5 posts since
Aug 13, 2013
Currently Being Moderated

Aug 14, 2013 1:55 AM

McAfee DLP does not recognize first instance of plug in event?

Hi all,

 

My corporate environment uses:

 

McAfee DLP Endpoint version 9.2.100.36

McAfee ePO version 4.6.0

 

As I have put in place a plug and play definition for the following to block off iPhones in the corporate environment:

bus type: USB

device class: imaging devices, windows portable device

device name: Apple (partial match)

 

Afterwhich, I have created a plug and play rule with the above definition to be blocked off for the users.

 

During testing, I have found out that the first instance of the device will be captured and installed onto the desktop. It is able to charge the phone connected and access the phone's folder to the content.

 

Upon the second instance of the event, the device was being blocked by the McAfee DLP and it wasn't be able to charge and get access into the folders.

 

Can I ask why is this so?

 

Thank you!

  • Tristan Veteran 790 posts since
    Dec 8, 2009

    Are the nessesary drivers pre-installed prior to this first connection.

     

    It's possible that the iPhone is presenting itself as/being detected as a Mass Storage device first before Windows has completed the driver set up.

  • vimalnavis McAfee SME 204 posts since
    Feb 23, 2010

    Try using a different parameter like Device Name. I have rare instances where one parameter works better over the other.

  • Scott Sadlocha Newcomer 40 posts since
    Jun 12, 2013

    I have seen somewhat of the opposite at my company. We want to allow reading from devices and charging. When I first connect an Android device, I get a popup warning as expected, and I am unable to save to the device but it charges. However, upon the second detection, the device is detected as a Windows Portable Device, and I am able to save files to it. If I enable a PnP rule, the device is blocked completely on the second detection and does not charge, but I am unable to see files at all.

     

    So it seems that there is an issue with the double detection, and I am unable to configure a rule to work. I want to use a Device Detection, but I have tried a number of parameters, and none work. When the device comes in as a Portable Device, it seems that a PnP is the only thing that will work, but it does a complete block.

More Like This

  • Retrieving data ...

Bookmarked By (1)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points