Harmony Endpoint - Block usb flash

[freeman91]

Hi, is there a working way to block USB device like flash, external HDD or SSD drive on laptop with harmony endpoint client installed.
Far now, I have created a new policy in Data Protection - General, and in Port Protection, i have blocked all 40 devices, and add a custom new one that targeting Palm OS Devices USB.

And it is not working.

[Ben_Dunkley]

If you are wanting to block all read/write activity to any attached storage device, the settings on the media encryption tab may be better than the port protection tab.

Block all, and add an exception for the specific devices you wish to allow.

i.e.

 

[freeman91]

okay but there is no option to not allowing poping up a file browser tab with USB at first place?

[Ben_Dunkley · Accepted solution]

Testing (with windows client version E88.72, and R82 mgmt), with a similar policy to the screenshot above (the only difference was I unticked the 'Allow deletion of file on read-only media' checkbox as well), the storage device gets blocked and there is a pop-up message:

The USB device does appear in explorer:

 

But attempting to open it gives an access denied message:

 

Is the desired behaviour that the storage device does not show in explorer at all?

[the_rock]

That looks totally correct.

[freeman91]

YES, I can accept this as a solution. Thank you.
Explanation in th guid is not so clear.

[freeman91]

Can you share entire policy setup for this, because for me it does not work. I can still read, write from and to USB Flash

[Ben_Dunkley]

I've highlighted the elements that I changed:

Have you checked that the endpoint client has correctly updated/applied the relevant policy? e.g.:

 

[freeman91]

it might be a problem, and I know now why 🙂

[the_rock]

Let me ask one of my colleagues, I believe he had a case with TAC about this while ago.