Views:
To correctly configure Device Control:
  1. Log on to the WFBS console.
  2. Navigate to Security Settings (for WFBS 9.5 and below), or Devices (for WFBS 10).
  3. Select a desktop or server group.
  4. Click Configure (for WFBS 9.5 and below), or Configure Policy (for WFBS 10).
  5. Click Device Control.
  6. Update the following as required:
    • Enable Device Control
    • Enable USB Autorun Prevention
    • Permissions: Set for both USB devices and network resources.
      Device Control Permissions
      PermissionsFiles on the DeviceIncoming Files
      Full accessPermitted operations: Copy, Move, Open, Save, Delete, ExecutePermitted operations: Save, Move, Copy.
      This means that a file can be saved, moved, and copied to the device.
      ModifyPermitted operations: Copy, Move, Open, Save, Delete
      Prohibited operations: Execute
      Permitted operations: Save, Move, Copy
      Read and executePermitted operations: Copy, Open, Execute
      Prohibited operations: Save, Move, Delete
      Prohibited operations: Save, Move, Copy
      ReadPermitted operations: Copy, Open
      Prohibited operations: Save, Move, Delete, Execute
      Prohibited operations: Save, Move, Copy
      No accessProhibited operations: All operations The device and the files it contains are visible to the user (for example, from Windows Explorer).Prohibited operations: Save, Move, Copy
    • Exceptions: If a user is not given read permission for a particular device, the user will still be allowed to run or open any file or program in the Approved List.
    However, if AutoRun prevention is enabled, even if a file is included in the Approved List, it will still not be allowed to run.
    To add an exception to the Approved List, enter the file name including the path or the digital signature and click Add to the Approved List.
    Specifying a Digital Signature Provider
    Specify a Digital Signature Provider if you trust programs issued by the provider. For example, type Microsoft Corporation or Trend Micro, Inc. You can obtain the Digital Signature Provider by checking the properties of a program. (e.g: right-click the program and select Properties)
    pccntmon.exe
    Digital Signature Provider for the Trend Micro security agent program (PccNTMon.exe)
    Specifying a Program Path and Name
    A program path and name should have a maximum of 259 characters and must only contain alphanumeric characters (A-Z, a-z, 0-9). It is not possible to specify only the program name.
    You can use wildcards in place of drive letters and program names. Use a question mark (?) to represent single-character data, such as a drive letter. Use an asterisk (*) to represent multi-character data, such as a program name.
    Important: Wildcards cannot be used to represent folder names. The exact name of a folder must be specified.
    Correct Usage of Wildcards:
    ExampleMatched Data
    ?:\Password.exeThe "Password.exe" file located directly under any drive.
    C:\Program Files\Microsoft\*.exeAny .exe file in C:\Program Files\Microsoft.
    C:\Program Files\*.*Any file in C:\Program Files that has a file extension.
    C:\Program Files\a?c.exeAny .exe file in C:\Program Files that has 3 characters starting with the letter "a" and ending with the letter "c".
    C:\*Any file located directly under the C:\ drive, with or without file extensions.
    Incorrect Usage of Wildcards:
    ExampleReason
    ??:\Buffalo\Password.exe?? represents two characters and drive letters only have a single alphabetic character.
    *:\Buffalo\Password.exe* represents multi-character data and drive letters only have a single alphabetic character.
    C:\*\Password.exeWildcards cannot be used to represent folder names. The exact name of a folder must be specified.
    C:\?\Password.exe
  7. Click Save.
Comments (0)