Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: After registering/approving a USB device, the device still remains inaccessible/blocked.

Carbon Black Cloud: After registering/approving a USB device, the device still remains inaccessible/blocked.

Environment

  • Carbon Black Cloud Sensor: All Windows versions
  • Carbon Black Cloud Server: All versions
  • Microsoft Windows OS: All versions / computers belonging to an Active Directory domain

Symptoms

A USB device cannot be written to even if the Carbon Black Cloud policy's in Enforce> Policy> Prevention > "Block access to unapproved USB devices" is disabled
and the user has waited at least 20 minutes for the policy change to download to the machine.

Running this command from an elevated command tool  > gpresult /V
may return > "Block DVD-CD and USB Access"
 

Cause

The computer belongs to an AD domain that also has a policy for USB devices set to Blocking USB devices.

Resolution

Disabling the AD GPO policy allows the CBC policy to function properly.
 

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-14-2023
Views:
237
Contributors