USB blocking

[Koldov]

EDIT: TL;DR - If a USB device is blocked by GPO, where is the log for this event?

 

Caused myself some confusion trying to troubleshoot this issue...

 

I went a little bit OTT with a belt and braces approach to this topic as we have both Sophos 'Peripheral Control' and the usual GPOs in place.

 

However, it gets overly complicated working out individual hardware IDs for Sophos and blocking all 'removeable storage' as a generic thing in the GPOs.

 

Things like cameras have to be set to camera and not mass storage, the school Galaxy G8 phones have to be separated from the personal Galaxy G8 ones and then blocking the phone/modem part whilst allowing the photos to be transferred, 3 different models of iPads etc.

 

Anyway... I have a teacher whose visualiser will not connect, to make matters worse it has been working fine for the last couple of years at least since I implemented USB blocking, but they recently moved classrooms and took the visualiser, plugged it in and it now no longer displays. The USB connection does briefly flash up, and I know the visualiser is fine for the following reasons:

 

It works fine as an administrator (this, I think rules out Sophos as there is no provision to exempt admin users), but I haven't changed anything in the GPOs which I thought might rule them out!

It works through a VGA connection directly to the projector.

 

Unfortunately the teacher likes the USB connection which allows them to use the associated software, my problem is it's impossible to troubleshoot as I've locked the laptops down so hard I cannot open Event Viewer or Device Manager whilst logged on as a user and logged on as admin everything is OK...

 

Trying to get the laptop is impossible and trying to fix it in the middle of a classroom is a nightmare...

 

The thing is the Visualiser is a big Aver model and it's quite a bit more than a USB camera on a stick, it appears to have mass storage capabilities, so I can see why it might be blocked. What I can't work out is why it was OK and only now isn't working, I can't seem to find anything relevant in Event Viewer when I log on as admin (it must log a blocked USB event somewhere?) and I can't tell which GPO has suddenly decided to block it. When I do log on as admin I think it's being recognised as its various components so ideally should block the 'Mass Storage' part, but allow the 'Camera' part... is this how it should work?

Edited September 6, 2023 by Koldov

[filteringtech]

Does it still work on the old computer in the old room for the teacher account?

[Koldov]

Sorry, should have been more specific!

 

They have individual laptops and took the visualiser from the old room to the new one... same laptop, same visualiser - that's what I'm finding hard to work out.

 

I just can't seem to find any way to see what's happening.

[robintech]

Does it work in another USB port on the laptop

[filteringtech]

Have you tried going into Device Manager and looking at the USB (hidden?) devices at the visualiser status when you are logged on as admin? I presume you can't get there on the teacher account? These thing can still sort of sometimes work even when they are not quite right and there is an error code.

 

Is it still plugged into the same USB port as it was previously?

[Koldov]

So, just to close the loop...

 

After 2 days of messing about with GPOs and Sophos, trying all sorts of settings at breaks and lunchtimes and after school, reboots, logging off and on as admin and then the user, remoting in and checking through event logs and device manager I had a eureka moment followed by a moment.

 

Whilst remoting on (obviously as admin) I could see the visualiser display in the software, I hit a button called 'side by side' and this then showed the visualiser and the laptop webcam image. So then when I logged in as the user I tried that... no visualiser but also no webcam, tried to open the webcam in VLC and Zoom... no webcam...

 

Well that's not a USB issues at all then is it... that's a general 'camera' issue... yep, you guessed it!

 

Settings > Privacy > Camera > Allow apps to access your camera > Off...

 

Is it half-term yet...?