How to configure Removable Media Protection to exempt devices

Technical Articles ID: KB81519
Last Modified: 8/19/2021

Environment

McAfee File and Removable Media Protection (FRP) 5.x
McAfee Removable Media Protection 5.x (offsite access options)

Summary

The Device Instance Path ID is used for exempting devices, and the exemptions are based on a substring match.

For example, if the Device Instance Path ID is identified as USBSTOR\DISK&VEN_KINGSTON&PROD_DATATRAVELER_G3&REV_1.00\001CC0EC321DFBC0B7172686&0, any of the following strings can be configured to exempt devices:

String	Comment
KINGSTON	This string exempts all KINGSTON devices.
DATATRAVELER	This string exempts all DATATRAVELER models regardless of whether the make is KINGSTON
DISK&VEN_KINGSTON&PROD_DATATRAVELER_G3&REV_1.00

Solution

Identify the USB Device ID, and then add it to the Device Exemptions field:

Identify the Device Instance Path ID. For steps see KB81447 - How to identify Device IDs to add to the Removable Media Exempted Device IDs list.
To add an entry to the Device Exemptions field:
1. Log on to the ePO console.
2. Select the Removable Media Policy.
3. In the USB Removable Media Protection Options section for Exempted Device IDs, click Add.
4. Enter the string against which the Device Instance Path IDs of devices inserted on FRP clients must be matched. For instance, if you want to exempt all Fujitsu devices, add Fujitsu and click OK.
5. Save your changes and apply the policy to the clients.

IMPORTANT:

There’s a character limitation of 3072 characters for the Device Exemptions field, so optimize entries in the field based on the guidance above.
NOTES:
- The above limitation has been removed with FRP 5.1.0.
- For backwards compatibility issues, see KB90987 - Limitation with device exemptions with File and Removable Media Protection 5.0.x and earlier.
FRP 5.4.0 and earlier
The serial number at the end of the Device Instance Path ID is ignored when you exempt devices. For example, if the entire string 'Device Instance Path ID' is added to the exemption list, the serial number part is filtered out. Only the rest of the string is used in the exemption.
FRP 5.4.1 and later
The above limitation has been removed in FRP 5.4.1. The serial number at the end of a Device Instance Path ID is no longer ignored. But, exemptions with only the serial number (for example; without a Bus, Vendor ID, or Product ID) might not work. In other words, if a specific device is to be exempted, it’s advisable to add the entire Device Instance Path ID to the exemption list.
Don’t end the Device Instance Path ID with a backslash (\) because it leads to the locking down of all policy options. The result is you being unable to edit any of the policy options. For details of this known issue, see KB87674 - Unable to edit a File and Removable Media Protection Policy.
The Device Instance Path ID might vary for the same device based on factors such as the system, USB connectivity (Example: A direct connection versus a connection through a hub). The Device Instance Path ID needs to be added to the exemption list, as and when a relevant component of the ID changes.

NOTES:

For USB devices listed under Exempt device IDs, the listed device isn’t updated with any changes in the encryption policies.
It’s impossible to exclude by Device Classes. For example, any iPad or BlackBerry device. This issue is being evaluated for consideration in a future release of the product.

To submit a new product idea, go to the Enterprise Customer Product Ideas page.

Click Sign In and enter your ServicePortal User ID and password. If you do not yet have a ServicePortal or Community account, click Register to register for a new account on either website.

For more information about product ideas, see KB60021 - How to submit a Product Idea.

NOTE: The Ideas forum replaces the previous Product Enhancement Request system.

Related Information

For help with modifying policies, see the File and Removable Media Protection Product Guide for your version.

For product documents, go to the Product Documentation portal.

Affected Products

Configuration
File and Removable Media Protection 5.4.x
File and Removable Media Protection 5.3.x
File and Removable Media Protection 5.2.x
File and Removable Media Protection 5.1.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Knowledge Center

How to configure Removable Media Protection to exempt devices

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

How to configure Removable Media Protection to exempt devices

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title