App Control: Does Agent initialization scan network drives or external USB drives?
book
Article ID: 288968
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
When the App Control agent is installed on an endpoint, and moved into an enforcemet (Low/Medium/High) policy, does the Initialization process scan network drives or external USB drives?
Environment
App Control Agent: All Supported Versions App Control Server: All Supported Versions
Resolution
The agent Initialization process ONLY scans devices that the agent sees as "Fixed Drives". USB drives, network paths, UNC shares, etc. are not identified as fixed drives and thus are exempt from scanning by the agent at agent initialization. Files executed from these alternate paths, or files moved onto a fixed device, will be seen and inspected by the agent at the time of file operations.