USB Devices

You can gain visibility and control over USB storage devices detected in your environment. In addition, you can create approvals for trusted devices, block untrusted devices, or monitor access to devices.

Carbon Black Cloud Device Control manages USB Mass Storage Devices (removable hard disks, USB thumbsticks, SDHC cards etc) connected to Windows and macOS machines. Depending on the underlying operating system, the USB Mass Storage Devices can have different behavior on Windows and macOS.

Device Control Support on Windows

To find out if the USB device connected to your endpoint is supported by the Device Control service on Windows, retrieve the device type and the interface type of the device by using the RepCLI utility on the endpoint.

repcli unlock <uninstall_code>

repcli device all

If the device all command returns the device type as a DISK and the interface type as an USB, the Carbon Black Cloud Device Control service supports that USB Mass Storage Device.

USB Device	Device Type	Interface Type	Device Control Support
USB Flash Drive	DISK	USB	YES
Built in SD Card slot	DISK	Unknown	NO
USB SD Card reader	DISK	USB	YES
USB External Hard Disk	DISK	USB	YES
Built in CDROM	CDROM	UNKNOWN	NO
USB External CDROM	CDROM	USB	NO
USB External Floppy Drive	DISK	SCSI	NO
USB MO	UNKNOWN	UNKNOWN	NO

Note:

Future Windows versions might recognize the current non-USB interface types as USB. Then, the Device Control service can start supporting such devices.

Device Control Support on macOS

On MacOS, the RepCLI utility does not support the device all command. Thus, you cannot determine if a specific device on your endpoint is supported by the Device Control service or not. If the USB Mass Storage Device is reported in Carbon Black Cloud and visible under the Inventory page, then it is supported.

The Device Control supports only USB devices with the device type being a Mountable Volume and the interface type as an USB.

Note: When device connects for the first time to an endpoint, it takes up to five minutes to synch the inventory in Carbon Black Cloud.

USB Device	Is Mountable Volume	Interface Type	Device Control Support
USB Flash Drive	YES	USB	YES
USB SD Card reader	YES	USB	YES
USB External Hard Disk	YES	USB	YES
USB External CDROM	YES	USB	YES
USB External Floppy Drive	YES	UNKNOWN	Partially Supported (Block rule is supported, but the device is not reported to the Cloud.)
USB MO	UNKNOWN	UNKNOWN	NO