1 2 Previous Next 10 Replies Latest reply on Jan 15, 2016 2:39 AM by ercole77

    Removable storage device recognized also as Plug and play device

    ercole77

      Hello

      i use DLP 9.4 and i have a strange problem.

       

      I have 2 rules in place:

       

      1) Removable storage device rule: blocks USB removable storage devices (tipically usb key storage) except a list of whitelisted device (by device instance id)

       

      2) Plug and Play device rule: blocks Windows portable device and is used to control smartphones and cameras.

       

      Now, if i insert any usb storage stick rule 1 works great (with a whitelisted device) BUT a popup appears saying RULE2 blocked the device. This is not true because the user can access it.

       

       

      Rule 2 lncident log

      Destination

       

      Device Name :
      E:\

       

      Device Class Name:

      Dispositivi portatili

      Device Class GUID :

      {EEC5AD98-8080-425F-922A-DABF3DE3F69A}

      Compatible ID:

      wpdbusenum\fs

      Instance ID :

      SWD\WPDBUSENUM\_??_USBSTOR#DISK&VEN_&PROD_&REV_0.00#1003069002D088&0#{53F56307-B 6BF-11D0-94F2-00A0C91EFB8B}

      USB Class:

      Vendor Specific

      Destination:

      dispositivi portatili

       

      Rule 1 log for the same device

      Destination

       

      Device Name :
      USB Device

       

      Device Class Name:

      Unità disco

      Device Class GUID :

      {4D36E967-E325-11CE-BFC1-08002BE10318}

      Compatible ID:

      USB\CLASS_08&SUBCLASS_06&PROT_50

      Instance ID :

      USBSTOR\Disk&Ven_&Prod_&Rev_0.00\1003069002d088&0

      Bus Type:

      USB

      USB Class:

      Mass Storage

      USB Serial Number:

      1003069002d088

      File System Access :

      Read/Write

      File System Type:

      FAT16

      Volume Serial Number:

      1AF7-3BAA

      Destination:

      unità disco

      USB (VID/PID Codes):

      1307-0165

       

       

       

      i alredy tried to create an exception list but the instance ID isnt recognized.

      I temporary solved the problem suppressing the popups but i still see the block action in the log (and i repeat, the device is accessible by the user).

       

      I guess why this happens (with version 9.3 i had no problems).....

        1 2 Previous Next