Device rules trigger only the unplug events on client systems

Articles techniques ID: KB85340
Date de la dernière modification : 12/22/2021

Environnement

McAfee Data Loss Prevention (DLP) Endpoint – all supported versions
McAfee ePolicy Orchestrator (ePO) 5.x

For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.

Problème

You configure DLP Endpoint device rules to Block, Monitor, and Notify user. But, DLP Endpoint pop-up notifications do not appear on the client when the removable storage devices are plugged in or unplugged. The DLP Endpoint Incident Manager console only records the Devices: Device Unplug event type.

The Windows Event Viewer does not record any entries and the DLP Endpoint Incidents Information shows only the following:

Reactions: Block, Monitor

Cause

This issue occurs when Windows group policy is configured to deny access for the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

Solution

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

To allow DLP Endpoint to function properly on the clients, you must remove the deny access permissions for the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

Produits affectés

Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.4.x (EOL)

Langues :

Cet article est disponible dans les langues suivantes :

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossaire des termes techniques

Mettez en surbrillance les termes du glossaire

Prenez un moment pour consulter notre Glossaire des termes techniques.

Knowledge Center

Device rules trigger only the unplug events on client systems

Environnement

Problème

Cause

Solution

Produits affectés

Langues :

Glossaire des termes techniques

Title

Title

Knowledge Center

Device rules trigger only the unplug events on client systems

Environnement

Problème

Cause

Solution

Produits affectés

Langues :

Glossaire des termes techniques

Choisissez votre région

Title

Title