Endpoint Security blocks USB storage device

Technical Articles ID: KB92442
Last Modified: 1/11/2022

Environment

Endpoint Security (ENS) Threat Prevention 10.x

Problem

When you connect a USB storage device or pen drive to a USB port, ENS blocks it. Windows Explorer doesn't show the USB device, and only lists the local drives.

The following entry in the ENS Exploit Prevention log confirms that ENS blocked the USB storage device.

NT AUTHORITY\SYSTEM ran System\System, which tried to access HKLM\SYSTEM\CONTROLSET001\SERVICES\USBSTOR\ENUM\, violating the rule "USB Storage Device Inserted", and was blocked.

Cause

Insertion of a USB storage device causes the creation of a registry key Enum under \HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR due to Exploit Prevention signature "USB Storage Device Inserted" with the Event ID 1157.

Solution

You must disable the signature "USB Storage Device Inserted". If the system is ePolicy Orchestrator managed, disable the signature in the ENS Exploit Prevention policy under signatures. For a standalone system, disable the signature manually in the ENS Client Settings options.

Affected Products

Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Endpoint Security blocks USB storage device

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Endpoint Security blocks USB storage device

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title