Los controladores de filtro heredados de otros fabricantes pueden afectar el comportamiento del cifrado de los medios externos cuando se tiene instalado Dell Encryption Enterprise

Productos afectados:

• Dell Encryption Enterprise

Sistemas operativos afectados:

• Windows

A medida que el controlador de filtro heredado realiza el monitoreo de medios externos, puede hacer que los archivos aparezcan quitados o eliminados en Shield. Como resultado, los archivos no se cifran como deberían según las reglas basadas en políticas.

Los registros de EMS muestran mensajes similares al siguiente:       

21.03.31 13:20:37.617 [I] [Volume "E:\"] [SWEEP] Starting full volume sweep! ContinuedSweep = 'F'
21.03.31 13:20:37.625 [I] Raising Event: "DeviceSweepStart".
21.03.31 13:20:37.687 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\CmgCryptoLib.mac"
21.03.31 13:20:37.690 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp.chm"
21.03.31 13:20:37.691 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_DE.chm"
21.03.31 13:20:37.692 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_ES.chm"
21.03.31 13:20:37.692 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_FR.chm"
21.03.31 13:20:37.693 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_IT.chm"
21.03.31 13:20:37.694 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_JA.chm"
21.03.31 13:20:37.694 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_KO.chm"
21.03.31 13:20:37.695 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_PT-BR.chm"
21.03.31 13:20:37.695 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_PT.chm"
21.03.31 13:20:37.698 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\VolEncInfo.iff"
21.03.31 13:20:37.766 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\VolEncInfo.temp.iff"
21.03.31 13:20:37.767 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\VolumeInfo.xml"
21.03.31 13:20:37.770 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\Access Encrypted Files (Mac).dmg"
21.03.31 13:20:37.773 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\autorun.inf"
21.03.31 13:20:37.773 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\newtest.pptx"
21.03.31 13:20:38.173 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_EMS_Config_Data_Dir_\VolEncInfo.iff"
21.03.31 13:20:38.173 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_EMS_Config_Data_Dir_\VolumeInfo.xml"
21.03.31 13:20:38.176 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\CmgCryptoLib.mac"
21.03.31 13:20:38.179 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp.chm"
21.03.31 13:20:38.179 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_DE.chm"
21.03.31 13:20:38.180 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_ES.chm"
21.03.31 13:20:38.180 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_FR.chm"
21.03.31 13:20:38.181 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_IT.chm"
21.03.31 13:20:38.181 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_JA.chm"
21.03.31 13:20:38.182 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_KO.chm"
21.03.31 13:20:38.183 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_PT-BR.chm"
21.03.31 13:20:38.183 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\EMSHelp_PT.chm"
21.03.31 13:20:38.186 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\VolEncInfo.iff"
21.03.31 13:20:38.188 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\VolEncInfo.temp.iff"
21.03.31 13:20:38.188 [W] [SWEEP] File deleted before we got a change to sweep it! "E:\_Encryption_Data_Do_Not_Delete_\VolumeInfo.xml"
21.03.31 13:20:38.189 [I] [Volume "E:\"] Encryption sweep finished: Result = 0x00000000

Aparece un banner de WSScan de los medios externos también muestra que existen cero (0) archivos cifrados en la unidad de medios externos.

La salida de elevación del controlador muestra un controlador heredado que se enumera encima de nuestros controladores CMG Shield:

Figura 1: (Solo en inglés) Unidad heredada sobre controlador de CMS Shield

No hay ninguna corrección disponible para este comportamiento aparte de la deshabilitación del monitoreo de medios externos del software.

Para comunicarse con el equipo de soporte, consulte los números de teléfono de soporte internacionales de Dell Data Security.
Vaya a TechDirect para generar una solicitud de soporte técnico en línea.
Para obtener información y recursos adicionales, únase al foro de la comunidad de seguridad de Dell.