App Control: Device Shows “Removable Device: No” Experiencing Unapproved Removable Block

[#1]

Environment

• App Control Server: 8.0 P4 - 8.6.x

Symptoms

• Device shows "Removable Device: No"
• Device experiencing blocks by the rule "Block writes to unapproved removable devices"

Cause

Known issue with recognizing USB Attached SCSI (UAS) Mass Storage Device Drivers incorrectly.

Resolution

1. Find the host ID of the endpoint experiencing the blocks
   • https://community.carbonblack.com/t5/Knowledge-Base/CB-Protection-How-to-Find-the-Host-ID-of-an-Agen...
2. Login to the App Control database server
3. Identify the device_id of the problematic USB device:

   SELECT * FROM das.dbo.devices WITH (NOLOCK) WHERE host_id='InsertHostIDHere'

• Another option to identify the device_id is using the Device Name (grab the value from console) 

  SELECT * FROM das.dbo.devices WITH (NOLOCK) WHERE name='InsertDeviceNameHere'

4. Set the drive to removable:

   UPDATE devices SET is_removable=1 WHERE device_id=InsertDeviceIDHere

Additional Notes

In 8.6+ we correctly identify these devices as removable (EP-7979). Devices affected prior to upgrade will need manually corrected.