SCCM 2012 and Endpoint Protection with a USB Drive
We are testing Endpoint Protection in SCCM 2012. I have gone through all the settings I can find and I do not see a way to scan a USB drive when it is plugged in? Is this possible? I only see a setting to scan a USB drive when doing
a regular quick or full scan. We need to have this functionality and without it I will be forced to continue paying for outside AV.
I need it to automatically scan a USB drive when plugged in and also not allow the user to cancel it. We currently have this with Kaspersky and it works great.
February 22nd, 2013 7:56pm
have you tried simply copying the eicar testfile 'virus' to a USB key, and inserting it into a SCEP protected computer ? what result did you get ?
February 25th, 2013 5:19pm
Yes I have tried that and it does see it however I need it to be able to run a scan of the drive as soon as it's plugged in and show the user it is scanning. We currently have Kaspersky and this will do that for us and also not allow the user to
stop the scan. Forefront will have to be put to the back burner yet again until microsoft can actually compete with other anti-virus software out there. It just does not have nowhere near the options as the others out there.
March 11th, 2013 3:03pm
If you want this feature added to SCEP, I recommend that you post a suggestion to the Connect site
https://connect.microsoft.com/ConfigurationManagervnext . Once you have done that, I recommend posting the link back here so that other may vote it up.
Without the suggestion, it will never get implemented.
March 11th, 2013 3:29pm
Garth,
That is a great idea however Microsoft is sooo far behind the other top AV's out there that I don't think we would consider using it in a production environment even with it being free and included in our sccm. It just doesn't even compete. Microsoft
Forefront is more like a basic AVG if you ask me. It does not allow all the functions that we use with other products such as Kaspersky now or previous ESET and Norton.
March 25th, 2013 4:01pm
whoops...
Before I found this thread I was absolutely sure I can find such an option.
Any ideas about a work around?
July 26th, 2013 9:32am