Despite using the subst command to mount folders as drives, the newly created drive doesn’t appear in the DLP (Data Loss Prevention) agent system

Products

• Data Loss Prevention

Issue/Introduction

When using the subst command to mount folders from a local drive as another drive, the Data Loss Prevention (DLP) system does not block moving files to the mapped drive.

Environment

DLP 15.8, 16.0 and later

Cause

The issue arises because the Data Loss Prevention (DLP) system enumerates the drives during boot, and the mapped drive was not included in the enumeration at that time.

 

Resolution

To ensure that the local folder is accessible during boot time and recognized by other DOS Devices, you can create the folder using either the net use command or by configuring it in the Windows Registry. Here are the relevant commands:

1. Mapping the Drive Using net use:
To map a drive letter X: to the folder \localhost\c$\Folder\Example, use the following command:
net use X: \\localhost\c$\Folder\Example

If you need to specify credentials (domain, username, and password), use this variation:
net use X: \\localhost\c$\Folder\Example /USER:<domain>\<username> <password>

2. Making the Drive Persistent After Reboot:
To ensure the drive remains mapped even after a system restart, add the following command:
net use X: \\localhost\c$\Folder\Example /PERSISTENT:Yes

3. Removing the Mapped Drive:
If you want to remove the drive mapping, use this command:
net use X: /Delete

These steps will help you manage the mapped drive effectively

To prevent the Data Loss Prevention (DLP) system from treating the mapped drive as a removable drive, follow these steps in the Windows Registry (regedit):

1. Navigate to the following path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices

2. Add a new REG_SZ value named X: (where X represents your desired drive letter).

3. Set the value data to the path in the following format:
\X\C:\Folder\Example

Replace C:\Folder\Example with the actual path to your mapped drive.
This adjustment ensures that the mapped drive remains accessible during boot and is recognized by the DLP system.