Version:
Netwrix Endpoint Protector Client 2608.1.1.3 / Server 2604.0.1.0, OS: Windows 11 Pro
Current configuration:
Under the Custom Classes menu, I have the “Allow access and include Custom Class in CAP scanning” option enabled for a custom class. However, this option only appears to be configurable/available when the custom class is based on the USB storage device class. Other device/storage classes (e.g., external HDD, CD/DVD, Thunderbolt storage, etc.) do not expose this same setting when defining a custom class.
Expected vs. actual behavior:
I expected to be able to enable “Custom Class in CAP scanning” for custom classes built on other storage device types as well, so that content-aware scanning rules apply consistently across all storage classes, not just USB. Instead, this option simply doesn’t exist/isn’t offered when the custom class is based on non-USB storage classes — it’s not that it’s disabled, it’s not there at all.
What I’ve tried:
Checked the Custom Classes settings for the affected storage device types and confirmed no equivalent toggle exists there.
Question:
Is this a by-design limitation (i.e., CAP + Custom Class only supports USB storage by architecture), or is there a way to extend this scanning behavior to custom classes based on other storage device types? If it’s by design, could you clarify the reasoning, and is there a roadmap item to support this for other classes?
“Allow access and include Custom Class in CAP scanning” under Custom Class is a legacy feature and in my experience is not very popular. It’s hard to tell now if it was a design choice or a technical limitation. Given that it’s not widely used, it’s also not on the roadmap to extend it to other storage devices.
Can you let me know what’s your use case for this feature? Perhaps there is another way to achieve it without using Custom Classes.
To minimize client resource usage, I intend to apply the CAP policy only to “Custom Classes” rather than all storage devices; therefore, I plan to set unused storage devices to “Access Denied” and configure the CAP policy to detect only the devices currently in use.
I see, thank you for detailing the use case. I don’t think there is a workaround for this.
That said, CAP scanning on storage devices is lightweight on client resources. It only kicks in when a file transfer to a monitored device is detected, so it’s not running a continuous background scan that would justify optimizing it away by restricting it to USB only.
Are you expecting significant data transfer volume to non-USB storage devices (e.g SD cards) in your environment? If resource usage is a genuine concern, I’d encourage you to open a feature request here on the Community so so our PM team can look into it.
The volume of data being transferred is not significant.
However, I am inquiring because the CAP policy requires selecting “All Storage Devices” if I want to include SD cards.
Consequently, when creating a policy, if even a single user utilizes an SD card, I have to either select “All Storage Devices” or create two separate policies as follows:
Policy for USB users (Custom Class)
Policy for USB and SD card users (All Storage Devices)
This is not a critical requirement; I simply reached out because I did not fully understand the “Custom Class” setting within the policy configuration.