I'm running a test of Data Loss Prevention 184.108.40.206, using a Removable Storage Protection Rule in Monitor only mode.. On one particular Windows 7 machine, it appears to be working at the client machine but when I go to ePO to run a report of the files that have been copied, I can’t find the workstation or the logged on user. For the other machine in my test group, I can run a report and see the workstation name, logged on user, evidence values, and a number of other pieces of information.
All workstations live in the same group container in ePO and as far as I can tell have the same DLP and EEFF Removable Media policies applied. Any ideas what could be causing this?
Any advice much appreciated.