Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 13 subscribers
  • Views 7560 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Lots of SAVOnAccess in Event Viewer, USB Flash-Drive not working

Kosta88

Hello,

if I just as usually use USB Flash-Drives to save data, all is fine. Never noticed any errors or problems.

But, if I try a different kind of access to the USB drive, which include:

- opening tools like Windows disk management or EaseUS Partition Manager

- Rufus

- Veeam Recovery Media Creator

- Diskpart

 ...the app freezes, I can't do anything with the program any more (I can only kill it via Task Manager) or I have to remove the USB-Stick.

As a test, I removed the Sophos from my computer, problem solved.

Seems like Sophos is preventing some low level access to the USB Flash-Drive.

I probably don't have something set up correctly - please tell me what.

And... I don't want to generally disable On Access scan to the USB Flash-Drives!

Thank you.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Kosta88,

    maybe this rings a bell with someone, maybe not. Haven't heard of restrictions that apply to USB devices or any settings that could have an effect. Therefore details are required.
    You mention Lots of SAVOnAccess in Event Viewer - why didn't you include these events in the post? Are all USB devices you use affected or just some? Can you tell vendor and model and do you know whether they use a special driver? Are you using Device Control?

    Christian

  • 0 in reply to QC

    Hello,

    Sorry for the missing info. There is an 1 event per minute, when I try to start Veeam Create Recovery Media.

    Event Viewer:

    The on-access driver could not check device control for volume \Device\Harddisk1\DR2.

    Event 769, SAVOnAccess

    Today I tried uninstalling Sophos on my client, and I was able to create the recovery media without an issue.

    I have tried two flash-drives, one being SanDisk and one Kingston. Both have the same problem.

    What I can add: disabling peripheral control, or exempting the flash drives completely solves the problem. But: that's not really what I'm looking for.

Reply
  • 0 in reply to QC

    Hello,

    Sorry for the missing info. There is an 1 event per minute, when I try to start Veeam Create Recovery Media.

    Event Viewer:

    The on-access driver could not check device control for volume \Device\Harddisk1\DR2.

    Event 769, SAVOnAccess

    Today I tried uninstalling Sophos on my client, and I was able to create the recovery media without an issue.

    I have tried two flash-drives, one being SanDisk and one Kingston. Both have the same problem.

    What I can add: disabling peripheral control, or exempting the flash drives completely solves the problem. But: that's not really what I'm looking for.

Children
  • 0 in reply to Kosta88

    Hello Kosta88,

    the 769 Event could be caused by a driver conflict. As it mentions device control - is Peripheral Control enabled? If so, please test what happens if you turn it off.

    As far as I can tell this is something that needs investigation by Support.

    Christian

  • 0 in reply to QC

    Exactly. See my reply above, I actually started writing it earlier than you replied again.

  • 0 in reply to Kosta88

    Hello Kosta88,

    See my reply above
    [:$] Exactly. I should lock my door to keep off animals, pests, and other distractions.

    So it's indeed processing required for Device Control. Other than the freeze there is no error or message from the applications I assume, is there?
    I don't have the Central version and could just check Disk Management (on Win7) - no problems. We have DevCtrl generally enabled (several thousand endpoints) and haven't heard of any issue of this kind.

    Christian 

Unfiltered HTML