Device Control makes it impossible to Safely remove external drive

[dream13]

I am using Kaspersky Endpoint Security version 12.7.0.533 AES56 (installed by company), Windows 11 build 22631.

I am unable to Safely remove external drive. I always get a message saying "Device currently in use" or "Device cannot be stopped". This happens even if I've just plug in the drive without doing anything. I tried disabling Device Control in Kaspersky out of desperation, and I can immediately safely remove my external drive! Is this some kind of bug? Should I disable Device Control? I don't want to, but I also want to be able to Safely remove my external drive before unplugging it...

[Tahmeed702]

Try with disabling Device control in Keswin policy settings first

Edited December 2 by Tahmeed702

[Renan Corassa]

It is very likely that since KES is monitoring activity on removable media, it could be the cause of the message.

[KarDip]

@dream13

The issue you're experiencing is likely due to Kaspersky Endpoint Security's Device Control feature actively monitoring or locking the external drive. This behavior isn't necessarily a bug but a result of how Device Control works. It monitors and enforces policies for devices connected to the system, which can sometimes cause conflicts with safely ejecting USB drives.

Here’s a step-by-step guide to troubleshoot and maybe resolve this issue without disabling Device Control entirely:

---

1. Verify Active Processes

• Open the Task Manager (Ctrl + Shift + Esc) and check if any processes or applications are actively accessing the drive.
• Sometimes, even Windows Explorer may hold a handle on the drive. Close all open windows and applications.

---

2. Exclude the External Drive from Scanning

Kaspersky might be actively scanning the drive, which prevents it from being safely removed.

• Open Kaspersky Endpoint Security.
• Navigate to Settings > Protection > File Threat Protection or Removable Drive Scan.
• Add your external drive to the exclusion list:
  • Specify the drive letter or use wildcard characters (e.g., E:\*).

---

3. Configure Device Control Settings

• Open Kaspersky Security Center (if managed centrally) or the local Kaspersky interface.
• Go to Settings > Device Control.
• Check if the policy is set to monitor or restrict external storage devices. If yes, adjust it:
  • Allow access with minimal restrictions.
  • Exclude specific drives from being monitored by Device Control.

---

4. Manually Force Ejection (with Caution)

If the issue persists, use the Disk Management tool to dismount the drive:

1. Press Win + X and select Disk Management.
2. Locate your external drive, right-click, and choose Offline or Eject.
3. After this, unplug the drive.

---

5. Update Kaspersky Endpoint Security

Ensure you’re using the latest version of Kaspersky Endpoint Security (KES) and that all updates are applied. A newer version or patch might resolve this behavior.

---

6. Consult Your IT Administrator

Since KES is managed by your company:

• Inform your IT team about the issue.
• Ask them to review Device Control policies or whitelist your external drive if necessary.
• Ensure that this change complies with your company’s security policies.

---

Should You Disable Device Control?

• Disabling Device Control is not recommended unless absolutely necessary, as it reduces your system's security.
• If disabling it temporarily resolves the issue, it confirms Device Control is the cause. Adjusting its settings (as outlined above) should resolve the problem.

• Let me know if these steps help or if further assistance is needed! ☺️

 

9 hours ago, dream13 said:

I am using Kaspersky Endpoint Security version 12.7.0.533 AES56 (installed by company), Windows 11 build 22631.

I am unable to Safely remove external drive. I always get a message saying "Device currently in use" or "Device cannot be stopped". This happens even if I've just plug in the drive without doing anything. I tried disabling Device Control in Kaspersky out of desperation, and I can immediately safely remove my external drive! Is this some kind of bug? Should I disable Device Control? I don't want to, but I also want to be able to Safely remove my external drive before unplugging it...

Edited December 3 by KarDip
added script