As a DLP Admin, I need to monitor file transfers via Microsoft Windows Bluetooth and 3rd party Bluetooth adapters connected via USB.
Microsoft Windows Endpoint.
3rd Party Bluetooth adapter (USB).
No incidents triggered when a file is transferred via 3rd party Bluetooth adapters to Bluetooth-enabled devices.
3rd party Bluetooth adapters may use different processes to access and transfer files.
Identifying the process access the files to be sent over Bluetooth is key to the solution. Microsoft sysinternals tool, Process Monitor, is key to identifying all processes and child processes used to access files for transfer.
By default, fsquirt.exe is enabled for Application Monitoring, but additional programs may need to be added in order to expand the monitoring capability of DLP Endpoint Prevent.
Enforce Control Panel> System>Agents> Application Monitoring> Add application
Example 1: BTWUIExt.exe
Subscribing will provide email updates when this Article is updated. Login is required.