When a Mac endpoint user moves multiple sensitive files to a removable storage device in quick succession, and the Block response rule displays a pop-up notification, the user can opt to apply a justification to all subsequent incidents. However, a pop-up still displays for each sensitive file that was moved to the removable storage device. This occurs because the Finder application launches a new process for each file that is moved.
When multiple sensitive files are moved to a removable storage device in Mac OS X Yosemite using Finder, the subsequent incident displays DesktopServiceHelper in the incident snapshot instead of Finder. This occurs because DesktopServiceHelper is the service that performs the copy operation.
Subscribing will provide email updates when this Article is updated. Login is required.