Verbose/Debug Logging Problems

Hello Anthony Stevens,

device [...] isn't running correctly
are you referring to the Failed to disable? Never found out (or bothered to find out) what the cause is. Primary question is whether the device can be accessed or not.

As for debug logging: Indeed, seems it doesn't work as stated in the article. Haven't tried it lately but it used to work (there was an additional key involved, I've set it when I tested just now). You should open a case with Support.

Christian

Hello Anthony Stevens,

device [...] isn't running correctly
are you referring to the Failed to disable? Never found out (or bothered to find out) what the cause is. Primary question is whether the device can be accessed or not.

As for debug logging: Indeed, seems it doesn't work as stated in the article. Haven't tried it lately but it used to work (there was an additional key involved, I've set it when I tested just now). You should open a case with Support.

Christian

Thank you for the response back.

The real reason why I'm checking with verbose logging is because the device control works and ends up disabling the CD/DVD-ROM drives on our desktops as intended, but for some reason it keeps trying to find the model of CD/DVD Drive that is installed in a Dell Optiplex 3020. (Which is one of the Dell models we own in the company.) It tries to find that first, fails and then on second attempt, finds the actual model installed and successfully disables it.

It doesn't help we need to receive emails about device control in case someone plugs something in they shouldn't do and the device control service will restart to find the drive again, haha.

Anyway, I'll try adding that additional registry key mentioned first and if that doesn't work, I'll raise a case with them then.

Anthony.

Hello Anthony,

trying to find the model of CD/DVD Drive that is installed in a Dell Optiplex 3020
could it be that other computers have been installed with an image taken from the 3020? I vaguely remember a case with some device that "was there somewhere in Windows" even though neither physically present nor visible in the Device Manager.

Christian

We can only say it is a possibility. The image in question was created back in 2016 before I started at the company and my colleagues can't remember themselves if that happened or not.

I did just narrow down the error to only occurring in one department of desktops, which all use the same image and that makes sense now.

But, I find it strange that could happen even though we run a sysprep process before the image is captured. Is it likely that some information on this non-existent drive is kept within the registry or somewhere else, that could cause Sophos to point at that drive first then? (Shot in the dark you could say.)

Well, we are going to be migrating our OS later this year anyway and we know it's working correctly despite the error. We may just roll with it for the time being since it's only an annoyance technically and see what happens after the migration is complete.

Thanks,
Anthony

Hello Anthony,

some information on this non-existent drive is kept within the registry or somewhere else
unfortunately I don't remember the exact details (if I ever knew them). Incomplete/inconsistent device information so that certain APIs find the device but others fail. The debug information would, I think, reveal what piece of information is retrieved by Device Control. Can't say if this enough information to remove the phantom without breaking something. Just searched for the DeviceID of my DVD drive and compared it to what I find with the ID of the drive that was previously installed. Obvious differences but nothing that would immediately suggest how it could look like for a phantom. Probably not worth digging deeper if it's not more than an annoyance.

Christian