Device Control Webcam

Hi Sven,

Thanks for reaching out to us. 

Could you try looking into device manager to view the properties of the integrated camera? From the Details tab, select "Device instance path" from the drop-down menu. Record the value shown here.

In the Peripheral Control Policy select "Add Exemptions" and try to locate the device using the "Instance ID". Let me know if this allows you to locate the camera. 

Hi Sven,

Thanks for reaching out to us. 

Could you try looking into device manager to view the properties of the integrated camera? From the Details tab, select "Device instance path" from the drop-down menu. Record the value shown here.

In the Peripheral Control Policy select "Add Exemptions" and try to locate the device using the "Instance ID". Let me know if this allows you to locate the camera. 

Camera is not showing up in Events in Central, all other device are shown.

I am not able to have an exception, cause device is not available as device in central.

Is it possible for you to create a new peripheral control policy from Sophos Central and apply settings so that all peripherals are blocked? Please apply this policy as a test to the affected device(s). 

If the camera is still allowed, please let me know. I will send you a PM requesting further details for investigation. 

I already have such a test rule, cause I am migrating from onpremise to central and need to set set device control rules.

I have two diffrent laptops with two diffrent external cameras, both are not blocked. They are even not shown in Central event log.

Sven

Hello Sven,

just curious, ESC's Device Control did detect the cameras (as MTP/PTP?) and you could block them?

Christian

I recommend checking what is logged in the following files.
- C:\ProgramData\Sophos\Endpoint Defense\Logs\SSPDevCon.log
- C:\ProgramData\Sophos\Endpoint Defense\Logs\SSP.log

If your devices are running the next-gen agent, the files mentioned above will be populated with the Instance ID that is associated to the peripherals. 

I recommend confirming if your devices are running the next gen agent by checking the following article under section "How do I know if I have migrated to the new architecture?"
- Sophos Intercept X for Windows: Product architecture changes