Microsoft Virtual Hard Disks (VHD) on a DLP Endpoint Agent machine used to store sensitive, proprietary, data needed for daily business operations.
The system storage host controllers and adapters for VHD use a storage bus type similar to a Removable Storage device.
To ignore the VHD monitoring from the Removable Storage channel monitoring, you can do this by modifying the Advanced Agent Setting as follows:
FileSystem.IGNORE_STORAGE_BUS_TYPE.str = BusTypeFileBackedVirtual
This should only ignore VHD, all other Removable Storage devices will be monitored as usual. The default value is ‘None’. Setting the value to ‘ALL’ will ignore all non USB disks.
The supported bus type values for Filesystem.ignore_storage_bus_type are:
ALL
NONE
BusTypeUnknown
BusTypeScsi
BusTypeAtapi
BusTypeAta
BusType1394
BusTypeSsa
BusTypeFibre
BusTypeUsb
BusTypeRAID
BusTypeiScsi
BusTypeSas
BusTypeSata
BusTypeSd
BusTypeMmc
BusTypeVirtual
BusTypeFileBackedVirtual
After changing the setting, make sure to apply the Agent Configuration.
In order to do it, click on on "Apply Configuration" on the Agent Configuration page and also "Update Configuration" for the groups that have the red question mark (!) besides the configuration name.after it redirects you to the Agent Groups page.