How to configure Removable Media Protection to exempt devices

Technical Articles ID: KB81519
Last Modified: 7/21/2021

Environment

McAfee File and Removable Media Protection (FRP) 5.x
McAfee Removable Media Protection 5.x (offsite access options)

For details of FRP supported environments, see KB81149.

Summary

The Device Instance Path ID is used for exempting devices, and the exemptions are based on a substring match.

For example, if the Device Instance Path ID is identified as USBSTOR\DISK&VEN_KINGSTON&PROD_DATATRAVELER_G3&REV_1.00\001CC0EC321DFBC0B7172686&0, any of the following strings can be configured to exempt devices:

String	Comment
KINGSTON	This string exempts all KINGSTON devices
DATATRAVELER	This string exempts all DATATRAVELER models regardless of whether the make is KINGSTON
DISK&VEN_KINGSTON&PROD_DATATRAVELER_G3&REV_1.00

Solution

Identify the USB Device ID, and then add it to the Device Exemptions field:

To identify the Device Instance Path ID, see KB81447.
To add an entry to the Device Exemptions field:
1. Log on to the ePO console.
2. Select the Removable Media Policy.
3. In the USB Removable Media Protection Options section for Exempted Device IDs, click Add.
4. Enter the string against which the Device Instance Path IDs of devices inserted on FRP clients must be matched. For instance, if you want to exempt all Fujitsu devices, add Fujitsu and click OK.
5. Save your changes and apply the policy to the clients.

IMPORTANT:

There is a character limitation of 3072 characters for the Device Exemptions field, so optimize entries in the field based on the guidance above.

NOTE: The above limitation has been removed with FRP 5.1.0. For backwards compatibility issues, see KB90987.
The serial number at the end of the Device Instance Path ID is ignored when you exempt devices. For example, if the entire string 'Device Instance Path ID' is added to the exemption list, the serial number part is filtered out. Only the rest of the string is used in the exemption.
Do not end the Device Instance Path ID with a backslash (\) because it leads to the locking down of all policy options. The result is you being unable to edit any of the policy options. For details of this known issue, see KB87674

NOTES:

For USB devices listed under Exempt device IDs, the listed device is not updated with any changes in the encryption policies.
It is impossible to exclude by Device Classes. For example, any iPad or BlackBerry device. This issue is being evaluated for consideration in a future release of the product.

To submit a new product idea, go to the Enterprise Customer Product Ideas page.

Click Sign In and enter your ServicePortal User ID and password. If you do not yet have a ServicePortal or Community account, click Register to register for a new account on either website.

For more information about product ideas, see KB60021 - How to submit a Product Idea.

NOTE: The Ideas forum replaces the previous Product Enhancement Request system.

Related Information

For help with modifying policies, see the File and Removable Media Protection Product Guide for your version.

For product documents, go to the Enterprise Product Documentation portal.

Affected Products

Configuration
File and Removable Media Protection 5.2.x
File and Removable Media Protection 5.1.x
File and Removable Media Protection 5.0.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

How to configure Removable Media Protection to exempt devices

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

How to configure Removable Media Protection to exempt devices

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title