Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 3 subscribers
  • Views 8716 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Device control failed to disable device: deviceId

KAR AAR

Dear All,

 

We are having this issue in 100s of machines. Would anyone please suggest any quick solution for the below error.

Computer name HostName
Computer description
Operating system Windows 7
Service pack Service Pack 1
Domain/workgroup Domain
IP address 10.51.14.92
Sophos Anti-Virus version 10.7.2 VE3.69.2
HIPS rules 10.3.221.1
HIPS configuration 1.0.65.1
Detection data 5.44
On-access scanning Active
Anti-virus and HIPS policy Same as policy
Last scheduled scan completed
Last message received from computer 17/10/2017 8:30:02 AM
Last logged on user Domain\User
Up to date Yes
Updating policy Same as policy
Time installed package became available 27/09/2017 5:39:13 PM
Time next package became available
Primary update server Server.com/.../
Secondary update server Sophos
Exploit prevention status
Exploit prevention policy compliance
Exploit prevention agent version
Client firewall enabled Yes
Client firewall policy Same as policy
Client firewall version 2.9.5
Client firewall mode Block by default
Application control policy Same as policy
Application control on-access scanning Active
Data control scanning status Inactive
Device control scanning status Active
Data control policy compliance Same as policy
Device control policy compliance Same as policy
Tamper protection status Inactive
Tamper protection policy compliance Same as policy
Patch assessment Inactive
Patch policy Same as policy
Patch agent version 1.0.311.1
Web control status Active
Web control policy Same as policy
Group \SUM_Script\SUM_Loc29

 

Best Regards

Faisal



This thread was automatically locked due to age.
  • 0

    When it comes to enabling/disabling devices, Device Control just uses the command line tool: SDCDevCon.exe

    For example, if you disable a device, it will cause the following to be called (in the case of this CDROM):

    "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SDCDevCon.exe" disable USBSTOR\CDROM&VEN_SANDISK&PROD_CRUZER&REV_7.01\432441143DC11528&1

    likewise to re-enable it, it would be:

    "C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SDCDevCon.exe" enable USBSTOR\CDROM&VEN_SANDISK&PROD_CRUZER&REV_7.01\432441143DC11528&1

    These commands are executed as local system as the device control service, which is running as system kicks off these commands.

    I hope this helps with your troubleshooting.

  • 0

    Hello Faisal,

    while these errors are probably annoying they are more or less "normal". Other than acknowledging them there's not much you can do. Please see also this rather old thread.

    Christian

Unfiltered HTML