Device rules trigger only the unplug events on client systems

Technical Articles ID: KB85340
Last Modified: 12/22/2021

Environment

McAfee Data Loss Prevention (DLP) Endpoint – all supported versions
McAfee ePolicy Orchestrator (ePO) 5.x

For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.

Problem

You configure DLP Endpoint device rules to Block, Monitor, and Notify user. But, DLP Endpoint pop-up notifications do not appear on the client when the removable storage devices are plugged in or unplugged. The DLP Endpoint Incident Manager console only records the Devices: Device Unplug event type.

The Windows Event Viewer does not record any entries and the DLP Endpoint Incidents Information shows only the following:

Reactions: Block, Monitor

Cause

This issue occurs when Windows group policy is configured to deny access for the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

Solution

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

To allow DLP Endpoint to function properly on the clients, you must remove the deny access permissions for the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

Affected Products

Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.4.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Device rules trigger only the unplug events on client systems

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Device rules trigger only the unplug events on client systems

Environment

Problem

Cause

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title