Issue

Sometimes Device Control errors in KES may occur. For example, hard drives are wrongly blocked when USB device blocking is enabled, or flash drive blocking is not happening although the policies require to do so.

In some cases, the reason for erroneous blocking is that the operating system (OS) is incorrectly identifying the device type.

Solution

As an example, if the policies prohibit access to flash drives, but this rule does not always work, you can check the following:

Go to Device manager and check the Removal policy parameter. The parameter value must be 2 or 3 if the OS has correctly detected the flash drive. If the parameter value is any other value other than 2 or 3, then the OS considers the attached device to be non-removable. Based on this data, KES decides to allow access to the device and not block it, and then informs the user.

Below we have added all the possible values and their descriptions which the Removal policy parameter can have: 

Removal policy 00000001 - ExpectNoRemoval (cannot be extracted at all)

Removal policy 00000002 - ExpectOrderlyRemoval

Removal policy 00000003 – ExpectSurpriseRemoval

Conclusion

If the flash drive is not blocked by KES and the removal policy parameter has a value other than 2 or 3, it means that the OS has detected the drive incorrectly. Thus, this is not a bug in the Kaspersky app.