3 Replies Latest reply on Jul 17, 2013 12:45 PM by dchau

    USB Defender and Android Smart Phones


      I have implemented USB Defender with the SWI-LEM 5.5 and it works well for most USB devices. If the device hasn't been white listed by its unique ID, it is blocked. If it is white listed, you can use the device.


      Welcome the Nexus One Android smart phone. When it is connected to a PC, no events are logged. The user can enable file sharing from a button on the phone and then copy files to and from the device as a mapped drive letter.


      I am looking for suggestions on how to stop/block this device in the same manner as any other USB device.

        • Re: USB Defender and Android Smart Phones
          nicole pauls

          The way USB-Defender works is that we log everything we detect about USB to the event log (devices attached, detached, etc) and then we only catch ones that we know are phones, mass storage, or network devices and pass them on to either the offline policy or the normalized event stream. This prevents you from accidentally detaching keyboards, mice, internal/external hubs, monitors, you name it, but it means some devices that don't announce themselves politely are missed until we can find them and add them in - provided there's something about them.


          Assuming you're not seeing anything about this attach even in the normalized stream (monitor in the console), if we can find the attach event corresponding to the device that is not coming in, we can take a look.


          Attach the device and look in the Application Event Log for the USB-Defender event that happened when you plugged that device in. If you can copy/paste that event here (or in DM/email) I can have the dev team take a look.

            • Re: USB Defender and Android Smart Phones

              Below is what appears in the application log after attaching the device. Nothing appears on the monitor in the console.


              USB Device Attached

              Device ID: USB\VID_18D1&PID_4E12\HT012P804191

              Serial number: HT012P804191

              Device name: \\?\usb#vid_18d1&pid_4e12#ht012p804191#{a5dcbf10-6530-11d2-901f-00c04fb951ed}

              Device path: \\?\usb#vid_18d1&pid_4e12#ht012p804191#{a5dcbf10-6530-11d2-901f-00c04fb951ed}

              Friendly name:

              Description: USB Composite Device

              Manufacturer: (Standard USB Host Controller)

              Device setup class: USB

              Setup class guid: {36fc9e60-c465-11cf-8056-444553540000}


                  Lock supported: No

                  Eject supported: No

                  Removable: Yes

                  Dock device: No

                  Unique ID: Yes

                  Silent install: No

                  Raw device ok: No

                  Surprise removal ok: Yes

                  Hardware disabled: No

                  Nondynamic: No


                  Disabled: No

                  Removed: No

                  Manual install: No

                  Ignore boot: No

                  Net boot: No

                  Reinstall: No

                  Failed install: No

                  Cannot stop a child: No

                  Can remove ROM: No

                  No remove at exit: No

                  Finish install: No

                  Needs forced configuration: No

                  Partial log configuration: No

              Driver software key: {36fc9e60-c465-11cf-8056-444553540000}\0011

              Service name: usbccgp

              Device address: 5

              Bus number: 0

              Bus type guid: {9D7DEBBC-C85D-11D1-9EB4-006008C3A19A}

              Device type:

              Enumerator name: USB

              Legacy bus type: 15

              Hardware location: Port_#0005.Hub_#0003

              Physical device object name: \Device\USBPDO-5

              Security descriptor:

              Hardware IDs::



              Compatible IDs:





            • Re: USB Defender and Android Smart Phones

              I have the same problem too, USB Defender does not detect the new Iron Keys as well.  I started using the USB Defender Extended and it was able to detect all Androids and the new Iron Keys.  But the problem is now it detaches everything else including mice, keyboards, etc.  I have to manually whitelist everything now.  It would be great if there was an alternative fix for this.