Endpoint Standard: USB Device Blocking Alert Missing Data And Cannot Be Approved

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• USB Alert block message in the console shows vendor and product ID as 0x0000
• Device cannot be searched, even when using the device serial number
• Device cannot be approved manually

Environment

• Endpoint Standard Sensor: 3.7.0.1503
• Microsoft Windows 10

Cause

Backend is not receiving a valid Vendor ID or Product ID 

Resolution

Open a case with Vmware Carbon Black Technical Support and provide the following

• Sensor diagnostics
• Endpoint Name
• Alert ID
• USB Device Vendor ID
• USB Product ID
• USB Drive Serial #