App Control: Approved Removable Device is Getting Blocks after Entering the Bitlocker Password

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Removable device setting on the policy has Active to block Write action on Unapproved Removable Devices
• Ntoskrnl.exe gets a block when using Bitlocker on an approved USB device

Environment

• App Control Console: All Supported Versions

Cause

It is a known issue in the product

Resolution

1. Log in to Console
2. Create a Custom Rule:

   Rule type: Advanced
   Operation: Write
   Write Action: Allow
   Path: \device\harddiskvolume*
   Process ntoskrnl.exe