Endpoint Standard: USB Mass Storage Device Not Present in the Inventory in Device Control

[#1]

Environment

•    Endpoint Standard Web Console: November '20 Release (0.60) and Higher
•    Carbon Black Cloud Windows Sensor: 3.6.0.1897 and Higher
 

Symptoms

A USB mass storage device is not present in the inventory.

Cause

This can happen when a device is unexpectedly classified as something other than a USB mass storage device by the Operating System. 

Resolution

• Please follow the steps outlined in this article to confirm whether or not the device is being classified properly
  • Endpoint Standard: How to Identify a Supported Device for Device Control?
• If the OS did correctly identify all three identifiers Product ID, Vendor ID, and Serial Number please open a case with VMware Carbon Black support.

Additional Notes

To provide visibility to the end user and security administrator, if blocking is enabled and this external device is being blocked, an Alert in the Carbon Black Cloud console will be created and the end user will be notified by a sensor UI pop up and log entry.
 

Related Content

Endpoint Standard: How to Determine USB Hardware IDs for Device Control?