A question :
Is the thumb drives / removable media drve letters the same on all endpoints ?
On our desktops yes, all of the thumb drives/removable media should be the same on all endpoints.
It can be done using the access protection rules (user defined) , though that is not what is suppose to be used for . PLeasetest this on your endpoint or a group of endpoints to verify if it meets your requirement:
policy catalog ----- > virusscan------>access protection----------- > user defined policy ----> new ---- > choose file or folder
in the "file or folder to block you can put in the drive letter and choose the actions
Save and test
Thank you, of course management is looking at this solution now when there is an audit a month away. This is really to convince them that they need DLP suite or implement controls through the domain controller. Thank you!!