I have one computer that logs a USB Peripheral Block Event locally on the Sophos Agent when a USB printer is plugged in, but the event does not get reported to the Central Management Console. The Sophos client is up to date and the computer has been rebooted. The Sophos client on the computer reports all the other events to Central but not this one peripheral block. Any ideas as to why or how to fix it? I need to exempt this USB device. Thanks.
Thanks for reaching out to the Sophos Community Forum.
Is it possible that the peripheral may have been plugged into the device previously and may already have an existing entry in Sophos Central, or is this a brand-new device?
If you believe this device may already be populated into Sophos Central, I suggest using Ctrl+F on the "Peripheral Exemptions" screen to see if you can locate it.
Thank you for the suggestions! It is not a new device, but I have been through the Event list for the device and there is no sign of it.
Try stopping and re-starting the "Sophos MCS Agent" and "Sophos MCS Client" services on the local device. Once done, check the "Endpoint Self Help" tool to ensure the Management Communication tab shows a recent successful communication.
If you remove and re-plug the USB drive once this is done, the event should be communicated to Sophos Central shortly after.
Let me know if this works for you.