DLP issue driver not installed - Hdlpdbk - removable storage blocking feature does not work

[tbloudek]

Hello I am running epo 5.9.1, agent 5.6.3, DLP11.4, ENS10.6, and DLP used to work well in past, after around 20 November I encountered DLP is no longer working well in means of blocking non-corporate USB flash drives - removable storage.

when I run diag tool I see possible cause - no blocking driver installed - could it be the issue (?)
I think other causes might be:
some certificate on driver or agent or epo level (?)
ENS exception for processes fcag*.exe missing (?)

Generally the DLP plugin is show in agent-tray-menu, GUI shows policy present, but upon plug of USB drive, no action is taken (block/report/info for user).

If there is more need for evidence or symptomps, or comment on what I tried, please let me know. Thanks for any advices or support.

[sbalamur]

@tbloudek Thank you for choosing McAfee Support Community.

HDLPDBK driver used in DLP to block device at Driver Level which is loaded when you use Plug and Play (PnP) Rule. From your description, I can understand you are using Removable storage rule to block USB which uses HDLPFLT which is already loaded in your machine.

I believe the device you are using may be detecting under PnP Device Type so it is allowed. Since the endpoint status for Device blocking is "No" i believe you have not configured PnP rule or the policy enforcement is not successful at the endpoint.

Please check the device detection type in HDIAG Tool and configure the rule accordingly to block it.

[VitezslavKu]

Hello we have a problem with hdlpbk driver. In device manager on W10 are USB device drivers in conflict and in windows event log is several warnings with: The driver \Driver\hdlpbk\failed for device USB\VID_808.......

We are using DLP 11.3 Device control removable storage and  plug and play device. When I turn off plug and play device so does not affect on the error.

Any idea how to quick fix it please? I'm already desperate....

Thank You very much.

[tbloudek]

Hello again, generally what I think worked for me, was to upgrade to MA5.6.3 and DLP11.4, make sure endpoints are rebooted, make copy of current policy apply it to one test machine, keep it reducing and simplyfiing until it start to work. Figure out using HDLP Diagnostic Tool possible conflicts with Removable Storage rules vs. PnP rules.

[VitezslavKu]

Thank you. So I'm going to try install newer agent and DLP.

[VitezslavKu]

Hello, the problem is not resolved by last version DLP and Last Version of Agent. Any ideas what do next?  Where can I get "HDLP Tool" what is on top?

Thank you very much.

[jsubbura]

Hi @VitezslavKu ,

So you still see this?

in windows event log is several warnings with: The driver \Driver\hdlpbk\failed for

Thank you.

[VitezslavKu]

Yes, exactly.

[jsubbura]

Hi @VitezslavKu ,

We have a POC fix for this issue, however its not available globally yet. 

I would request you to open a service request, so that the McAfee Support can confirm your issue and provide you with the POC or HF.

Kindly make a reference of this community post in the ticket.

Thank you.