Hello,
I have set Device Control to block all devices, but webcams are not logged or blocked. But they are addes as camera/imaging device.
We want only allowed and tested cameras to be used.
Sven
I recommend checking what is logged in the following files.
- C:\ProgramData\Sophos\Endpoint Defense\Logs\SSPDevCon.log
- C:\ProgramData\Sophos\Endpoint Defense\Logs\SSP.log
If your devices are running the next-gen agent, the files mentioned above will be populated with the Instance ID that is associated to the peripherals.
I recommend confirming if your devices are running the next gen agent by checking the following article under section "How do I know if I have migrated to the new architecture?"
- Sophos Intercept X for Windows: Product architecture changes
Hi Sven,
Thanks for reaching out to us.
Could you try looking into device manager to view the properties of the integrated camera? From the Details tab, select "Device instance path" from the drop-down menu. Record the value shown here.
In the Peripheral Control Policy select "Add Exemptions" and try to locate the device using the "Instance ID". Let me know if this allows you to locate the camera.
Is it possible for you to create a new peripheral control policy from Sophos Central and apply settings so that all peripherals are blocked? Please apply this policy as a test to the affected device(s).
If the camera is still allowed, please let me know. I will send you a PM requesting further details for investigation.
