1 Reply Latest reply on Aug 10, 2015 8:26 AM by mmcgary

    Monitor documents copy with access protection rules.





      I would like to monitor file transfer  such as word docs via RDP on the target machine. I tried to create access protection rule like the  one below, but it does not work if the source user copies docs via RDP, it works only if the target computer user copy docs from folder to another or from drive to drive. Is there a way to do that? It looks like even host dlp does not support that I am not sure. I am sure that host dlp supports removable storage devices, email and instant messaging (IM) that is why I am trying to do the monitoring with access protection rules.


      I appreciate your help




        • 1. Re: Monitor documents copy with access protection rules.

          You can't put multiple, comma separated values in the "file or folder name to block" field. I don't believe it will have any behavior blocking at all, at least with my testing it didn't. You might try setting up 2 new rules on both systems, for logging only, with "processes to include" * and "file or folder name to block" *.docx for one rule and *.pdf for the other and see what sort of violations you receive. You might want to select all of the "File actions to prevent" (minus 'Files being deleted') until you find the correct action you're looking for.