Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Unable to Approve Hard Drives that are Being Recognized as SCSI Drives

App Control: Unable to Approve Hard Drives that are Being Recognized as SCSI Drives

Environment

  • App Control Server: All Versions
  • App Control Agent: 8.6.0 and Lower

Symptoms

  • USB hard drives are being reported as SCSI devices
  • Unable to approve the USB hard drives for read/write access

Cause

A defect was fixed in the 8.6.0 version where the Agent was not correctly identifying some devices as 'removeable'. Despite this fix the Server may retain the original device_id value from the first time the device was seen.

 


Resolution

  • Upgrade App Control Agent to v8.6.0 or higher
  • To change the USB device to removable, execute the following SQL statement in the 'das' database:
UPDATE dbo.devices SET is_removable=1 WHERE device_id=<id>

 

Additional Notes

  • To locate the device_id of USB device open following URL in the Console ->  https://<app_control_servername>/Events.php?InternalEvents
  • The device_id will be listed in the Description field of blocking event
  • The fix will be applied only for the devices attached after 8.6.0 Windows Upgrade
  • If the device was attached before this upgrade, apply the solution because the server retains the original value from the first time the device was seen

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-06-2022
Views:
60
Contributors