A user has asked for a printer/scanner to be unblocked via device control. At first the model ID of the device was shown in the events of both Endpoint and Central and I was able to add an exemption for the device. However, this only unblocked the printing functionality of the device and the scanner remained blocked, each time the events shown in Endpoint stated, "Use of device has been blocked by your administrator". The lack of device or model ID shown in the event resulted in no block being shown in the "Add exemptions" list for the policy control.
Does anyone have a solution to this issue?
Thanks for reaching out to the Sophos Community Forum.
I suggest checking the following two log files after the block action occurs.- C:\ProgramData\Sophos\Endpoint Defense\Logs\SSPDevCon.log- C:\ProgramData\Sophos\Endpoint Defense\Logs\SSP.log
Let me know if this allows you to find the device ID.