Configuration Protection USB 3.0 Root HUB blocked

Safeguard sometimes blocks 'unclassified devices' even if your policy permits unknown devices.

Use the port auditor to scan one of the laptops and add the device which is being blocked into your white-list.

Hope this helps.

Hi,

I have a problem with a USB 3.0 Root Hub too and your issue maybe the same as ours?:

• Device: NEC Electronics USB 3.0 Root Hub
• PNP Device ID: NUSB3\ROOT_HUB30\5&2B8F22CB&0

NB: This is in a Lenovo W510 (Model 4319-249G) laptop.

I think the problem here is that the device is listed as a NUSB device and SafeGuard CP can only see 'USB' / 'PCI' / PCMCIA' / 'IDE' devices etc. (Manually adding 'NUSB' to a CP whitelist does not work, as CP complains that 'NUSB' is not supported).

Even if you scan for all devices (connected or previously connected) using CP PortAuditor then the device is not listed.

Trouble is that 2 out of the 3 USB ports on the laptop are rendered useless when using SafeGuard CP! Even HID's won't work when attached.

Authorising 'UNKNOWN' devices doesn't help either.

Regards,

John

P.S. There is a Sophos KB article (111012) which lists issues with this laptop and USB3, but only mentions POA and not CP whilst windows is loaded.

I have raised a Sophos support case '2972319' and will update this ticket with the final outcome...

Okay, so this is weird...

I had a Sophos Pro Services rep here with me and we both try a myriad of things to try get the USB3 Root HUB to work, but to no avail. - Thus the reason for raising the Sophos support ticket.

Another day goes by and I alone try some other things. I then give up and reply to this thread (as per my above post) in the hope that (A). it may help the other Sophos user, and (B). someone may help us. ;)

An hour goes by and I have changed nothing, and there are no devices authorised in the Whitelist, and like magic the USB3 Root Hub enables itself. I have changed nothing and ensured I synced twice on the previous changes. 

Did someone in Sophos just push out a silent update ? :smileywink:

When I get an hour spare I will rebuild my laptop and try this from scratch, Just to eliminate any actions that may have happened between it not working and then working...

@RL - John

you're perfectly right ! Can't add NUSB in whitelist but no magic for me:smileysad: . Device is still blocked and no way to get around it.

Let's see the outcome of your support case.

Regards,

schgu

Thus far the Sophos UK support team have escalated the case to the SafeGuard team in Germany...

Hi John

Moving the issue to Germany normally means:

1. Supporter telling you "that they never heard of that problem before"...

2. Sending tons of logs

3. waiting

4. Support tells you that they will fix the problem in version X

I hope this won't be the case here...:smileyvery-happy:

regards.

schgu

Hi schgu,

From the looks of things, like you I am very familiar with the Sophos suport and development lifecycle.

I had preempted some of the points you raised, so I'd already created the following before I raised the case:

A. Detailed description of the issue

B. SDU logs

C. MSInfo output

D. SGN trace logging (set at '0').

I then knew it would as you said, be a waiting game, only to hear the suspected answer back from Sophos support...

QUOTE "Hello, I have been advised that USB 3.0 is supported with version 6.0 that is due for release in the new year. If USB devices work at the PoA level by using USB 2.0 or / and USB 3.0 port then we would not expect to see any problems at the Windows OS level as well. However, if we see some issues at the PoA level (because of using USB 3.0 Port in this case) then we need to expect that issues can happened at the Windows level as well. I believe the Article on our website is being modified to reflect this, as the message at the moment is a little confusing."

Unfortunately this is the kind of answer I have now come to expect from Sophos...

I am often amazed how some products ever get past QA, especially at the rate in which I find new defects, which by the way are often core offerings from the products, only to be told to wait 6 months or so for a fix.

Couple that with I have a defect still open at the moment that has been oustanting for over 18 months, and the only workaround was to deploy Windows 7 to my entire environment (as the defect was only seen in Windows XP), I am not best pleased with Sophos SafeGuard Quality Assurance testing, and their customer support to say the least.

So for me version 6 is meant to fix:

A. This problem

B. A new defect with Hybrid / Bridging in SGN CP 5.60.0.192 and 5.60.1.7 (Defect 70425)

C. SGN DX key problem on Windows XP (Defect 62251) which was mean to be fixed in 5.50.1 LOL!

Oh, and I'm hoping that version 6 will eventually have e-SATA port and device control - seeing as this is one way of bypassing both End Point protection and SGN CP!

Hi John

LOL - they really told you something about Version 6 ??!! I remember having a case at german support concerning a Device Encryption problem aprox. 2 years ago. at that time the supporter told me to wait for Version 6 ! which of course never has been released.

I think this is the "buzz off and solve the problem yourself" Version.... :smileyvery-happy: and that was exactly what i did. I don't know how many years you have got left till retirement. For my part still 15 years to go. If i'am lucky Version 6 will be released before that.

schgu

Hi Schgu,

Guess what's been released ;)

I hope it's all you were looking for.

Regards,

John