This article applies to:

• Marshal EndPoint Security

Symptoms

• Access to scanners is denied for some users

Causes

The administrator is likely to have denied access to Digital Cameras Device Class for these users. Unfortunately some scanners look like Digital Cameras to EndPoint Security and the scanner is blocked.

Resolution

The issue can be resolved by creating a new Device Class to manage the scanners separately. This is achieved as follows:

1. On the client computer, find the line in DevWal1u.log (or DevWal2u.log) that shows disabled access to the scanner. It helps if one knows the make and/or model number of the scanner in advance. For instance:
   
   16/01/2006 14:26:44 DEVICEWALL: Disabling unauthorized device fi-4530Cdj (dwStatus = 180600A)
   
2. On the client computer, check DWHWList.dat for the scanner model, for instance:
   
   [Image] [fi-4530Cdj]
   
3. On the EndPoint Security server, add a new DeviceGroup and DeviceClass to the POLICY.XML file in the Policy directory.

   Note: The ID for the Device Class name must be unique and the new Device Group must be added above the Digital Cameras group.  (Substitute the actual scanner model you found.)

   
   The security descriptor is -system Full - - Built in Admins Full - - Everyone Full -
   
   <DeviceGroup name="Imaging Devices">
   <DeviceClass name="Scanners" icon="16" id="99">
   <SecurityDescriptor>D:AR(A;;FA;;;BA)(A;;FA;;;WD)(A;;FA;;;SY)</SecurityDescriptor>
   <CustomData>HWDevice=[Image]fi-4530Cdj</CustomData>
   </DeviceClass>
   </DeviceGroup>
   
4. You may find the PCs affected must be restarted before the Scanner driver correctly recovers after you deploy the new policy.
5. The above process can be repeated for additional scanner models by adding additional Custom data sections to the newly created scanner device class in POLICY.XML
   
   <CustomData>HWDevice=[Image]Another Scanner Model</CustomData>
   
   Be aware that partial matches are allowed so if you have lots of HP Scanjets but different models using the description Scanjet will block all Scanjet scanners, for example;
   
   <CustomData>HWDevice=[Image]Scanjet</CustomData>

Note:

You may be able to perform this process as a drag-and-drop operation in the Policy Customizer Tool on the EndPoint Security server.