Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Unable to Approve Hard Drives that are Being Recognized as SCSI Drives

App Control: Unable to Approve Hard Drives that are Being Recognized as SCSI Drives

Environment

  • App Control Console: All Supported Versions
  • App Control Agent: 8.0.x - 8.5.x
  • USB Device originally attached while a matching Agent version was installed

Symptoms

  • USB device was first attached while Agent 8.5.x (or lower) was installed.
  • USB device being reported with the Device Class: SCSI Device.
  • Unable to issue an Approval for the USB device due to being a Non-removable Device.

Cause

A defect in the Agent was not correctly identifying some devices as 'Removable'. This defect was tracked under EP-7979 and fixed with the release of Agent version 8.6.0.

Resolution

Upgrading to Agent version 8.6.0 or higher will prevent this issue. However, if the device_id was first seen by an impacted Agent version, the issue on the Server may persist.

To alter the Removable state of a device first seen by an impacted Agent version:
  1. Log in to the application server as the Carbon Black Service Account.
  2. Use SQL Server Management Studio to execute the following query:
    use das; select device_id, host_id, first_seen_date, name, vendor, friendly_name, is_removable from devices (nolock)
  3. Locate & verify the relevant device_id
  4. Using the device_id in place of X, adjust the device's status with the following query:
    use das; UPDATE devices SET is_removable=1 WHERE device_id=X
  5. Attempt to issue the Approval.

Additional Notes

  • These steps should only be followed for devices originally attached to the endpoint while Agent 8.0.x - 8.5.x was installed. 
  • If encountering this issue for devices that were attached after 8.6.0+ was installed, please open a case with Support instead.
  • The device information collected by the Agent should match what Windows reports in
    System Information > Components > Storage > Disks > relevant Disk Drive > Media Type

Related Content


Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-06-2022
Views:
342
Contributors