USB blocked in the Symantec Endpoint Protection device control rule is not showing log

[celestiall]

I have installed Symantec Endpoint Protection in my system and I have also blocked one USb and have allowed two usb top work in the SEP device control rule and the problem that I a facing is that I am able to get the log of the allowed devices in the security log but then I am not getting the logs for the blocked devices, I have tried out setting the notify user option but then it does not seems to be working, is there anyone who has faced the same and has an idea about it??

[shetty]

I have installed Symantec Endpoint Protection in my system and I have also blocked one USb and have allowed two usb top work in the SEP device control rule and the problem that I a facing is that I am able to get the log of the allowed devices in the security log but then I am not getting the logs for the blocked devices, I have tried out setting the notify user option but then it does not seems to be working, is there anyone who has faced the same and has an idea about it??

Have you followed the instructions in the below article:

• How to block USB flash drives while allowing other USB devices.

• How to block USB Thumb Drives and USB Hard Drives, but allow specific USB Drives in the Application and Device Control Policy in Symantec Endpoint Protection.

[TABLITA]

I just wanted to know if you have checked out the policy for logging?? I also wanted to know that what is the SEP 12.1 version in your case, is it RU 1 or something else? If you have not checked out the policy then check it out and make sure that the logging is enabled in your case.

[celestiall]

Yes, it is RU1 in my case and I have also checked out the policy and I have enabled the Log files written to USB as well as for the notify users, I also wanted o share that when I am doing blocking then other devices like data card etc are also getting blocked. I have followed some threads from the Symantec site and I have also enabled USBSTOR in order to block one usb and allow other two but then when I applied their solution then all usb are getting blocked even the allowed ones, what should I do, is there any workaround that I can try out??

[Eeshika18]

I am not very sure but then I have found that if we use * then we will have to remove the same in order to allow the allowed device in exception list, so if you have used the same then remove it and see if it is making any difference.

[celestiall]

I have used * in my case and I have found that when I am adding it after the USBSTOR then all the devices in that category is getting blocked where as if I am removing the same then all the device are working, I have checked it out by using a no of usb device that I had even the ones that I wanted to block. I have been going through the above articles as well but then I have found that some of the devices like multi mouse connector, data cards is also getting blocked as that of the usb composite devices, I am really running out of ideas, is there effective solution that can help.

[Nearer]

I was having the same case and I was looking after a solution for the same but then later I found that the data cards were blocked in the class ports and I had just allowed modems but then after adding exception the data cards were working fine, I am not very sure if you are having the same case but then you can at least check it out.