DLP 11.4 - Printers showing up as "Mass Storage" Devices

[aero0725]

Hello All,

I have attached two pictures which show DLP reading the USB printer as a printer and then showing up as a mass storage device. Is anyone else seeing this happen on their network? 

[awbattelle]

How did you define your mass storage devices? 

Here is how we did it;

There are a couple of ways to do it. Obviously, if I had not included the USB class code, then printers would have been included. Another way would be to create a custom Mass Storage rule and exclude USB printers.  DLP is very tricky. We thoroughly test all our rules before placing them in production. One of the things we look for in testing are conflicts in the rules.

Let me know if my post rings any bells!

[jsubbura · Accepted solution]

Hi @aero0725 ,

Thank you for writing in here.

You are seeing that your printer is getting detected as printer and as well as USB mass storage media.

I have many such instances and not to worry in here.

Its basically how windows detects a device, kindly connect your USB printer and go to Device Manager and check under Disk Drive section, you will have your Printer listed there as well , because of this DLP has identified that device under Disk Drives and triggered an Incident based on the rules which you have configured in your policy.

Manufactures of external devices manufacture devices in such a way they load many drivers into windows for its proper functionality. So dont worry its not a fault with DLP or Windows, its how the devices are manufactured and coded.

Thank you .