mteehan

So I just did this: Disabled real-time protection via the GUI Plugged in the drive It didn't work Restarted my computer Disabled real-time protection via the GUI Plugged in the drive It worked Unplugged the drive Plugged it back in again (real-time still disabled) Now it doesn't work again When real-time was disabled after renaming eamonm.sys I did try the drive multiple times so I know it did work reliably in that case.

Disabling device control integration did not fix it. Renaming eamonm.sys DID fix the problem. I didn't bother renaming ehdrv.sys since the previous step worked. So I guess now I need a solution somewhere in the middle. Any thoughts?

Thanks Marcos, I sent you the logs. It actually worked today, once, on a new USB port. It hasn't worked since. I didn't change anything so I have no idea what made it work. Unfortunately I didn't have anything running at the time but maybe the ESET logs will show something useful.

We're still not 100% it seems. That solution worked for one user (or at least they have not complained yet) but my own drive is still not working correctly. As I mentioned before, this is only a problem on Windows 7. Not sure why that would matter but XP users have no issues. We have a "Removable Media" group set up that allows access to USB drives and I am a member of this group. We have no blocks in place that take priority over our allow rules. The device logs show nothing being blocked on my machine, only "allow" actions.

Here's the solution we ended up using.

Hello, I have tried a temporary disabling of device integration and that does not fix it. We do have an AD group set up to allow access to USB drives and that group does have permissions for all removable media.

Hello, We use IronKey secure thumb drives and their newest ones are having issues working with ESET Endpoint Security and Windows 7 (they work fine on XP). I was wondering if anyone else has had a similar experience and found a solution. We've already added exclusions for the IronKey executable as well as setting up the appropriate rules under Device Control to allow access. If you look in the device control logs, it says the device was allowed but it does not work. Any help would be appreciated. Thanks.