Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 - ADMINISTRATION Administration Manual page 89

filter matches. As with many other fields in the ZENworks Management Console, when being set on
a location, the USB Devices value can also be set to Apply Global Settings and the global value of
this field will be used instead.
The client gathers the filters that are applied from the policy, based on the location and global
settings.
The client will then group the filters based on access into the following groups:
Always Block: Always block the device. This setting cannot be overridden.
Always Allow: Always allow access unless the device matches an Always Block filter.
Block: Block access unless the device matches an Always Allow filter.
Allow: Allow access unless the device matches an Always Block or a Block filter.
Default Device Access: Give the device the same access level as Default Device Access if no
other match is found.
A device is evaluated against each group in the above order (first the Always Block group, followed
by Always Allow, and so forth). When a device matches at least one filter in a group, the device's
access is set to that level and evaluation stops. If the device is evaluated against all filters, and no
match is found, the Default Device Access level is applied.
Device Access set in the Device Group Access area is considered along with all other filters being
used at that location. This is done by generating matching filters for each of the grouping when the
policy is published to the client. These filters are as follows:
Device Group Access:
Human Interface Device(HID)
Mass Storage Class
Printing Class
Scanning/Imaging (PTP)
Advanced
In most situations, the four device groups listed on the USB Connectivity page (Human Interface
Device, Mass Storage Class, Printing Class, and Scanning/Imaging) are sufficient to allow or deny
access to most USB devices. If you have devices that do not register in one of these groups, you can
configure settings on the USB Connectivity Advanced page. You can also use the settings on the
Advanced page to provide whitelist access to certain devices even though they might be denied
access because of the settings on the USB Connectivity page.
To access the Advanced USB Connectivity options, click the plus sign next to USB Connectivity in
the Global Settings tree, then click Advanced. You can use the USB Device Audit report as a means
of getting all the information you could potentially use on the USB Connectivity Control Advanced
page.
Filter:
"Device Class" is equal to 3.
"Device Class" is equal to 8.
"Device Class" is equal to 7.
"Device Class" is equal to 6.
Creating and Distributing Security Policies 89