App Control: Does Agent initialization scan network drives or external USB drives?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

When the App Control agent is installed on an endpoint, and moved into an enforcemet (Low/Medium/High) policy, does the Initialization process scan network drives or external USB drives?

Environment

App Control Agent: All Supported Versions
App Control Server: All Supported Versions

Resolution

The agent Initialization process ONLY scans devices that the agent sees as "Fixed Drives". USB drives, network paths, UNC shares, etc. are not identified as fixed drives and thus are exempt from scanning by the agent at agent initialization. Files executed from these alternate paths, or files moved onto a fixed device, will be seen and inspected by the agent at the time of file operations.