I need a solution
I have a endpoint prevent policy that is working well to detect anyone trying to write a limited number of file types to removable storage. However, if I also include the local drive as a destination, it does not see the write (while it continues to detect the write to removable storage). I can't find anything in the admin manual that indicates that you can monitor the local drive with endpoint prevent but the policy writer offers the local drive as an endpoint destination to monitor. Is it even possible to use endpoint prevent to monitor someone writing certain file types to their local drive?
0