Supported Device Types in Ivanti Device Control

Ivanti Device Control (Device Control) supports defining access permissions for most standard device types such as removable storage devices, and biometric devices. You can also grant permissions at device type level and restrict them to a particular bus type, such as FireWire, USB, ATA/IDE, PCMCIA, Bluetooth, SCSI, and IrDA buses.

Actual creation of permissions depends on the type of device and not the mode of connection. For example, a DVD-ROM drive connected to a PC through its USB port is controlled by the same settings and mechanism as the computer’s internal DVD-ROM drive. Device Control can also recognize Plug and Play devices and subject them to the same access permissions as those granted fixed devices of the same type.

For Plug and Play devices in Windows operating systems, Device Control applies permissions based on the device class to which Windows registers the device. For example, if Windows registers a camera under the Removable Storage Devices class, access is granted based on the permissions applied for the remote storage device class.

Device Control manages most of the commonly used device types, including:

Device Type

Description

Biometric devices

This device type includes fingerprint readers and password managers. Connection to the computer is via the USB port.

COM/serial ports

This category includes serial ports and devices using COM device drivers, such as terminal adapters and certain modem types. PDA cradles that are connected through a USB port may also use the serial port.

Some devices will work only if access permission to the COM port is enabled. For example, a Bluetooth printer configured to use a COM port provided by a Bluetooth adopter will require access to be enabled for both the adapter and the COM port.

CD/DVD drives

Device Control allows varied access management for CD/DVD-ROM drives. You can lock or unlock drives completely, or allow access only to drives that are authorized by the company.

Floppy Disk Drives

Access to floppy disk drives can be managed as read-only or completely unlocked/ locked. These include regular diskette drives and high-capacity drives like the LS-120.

Imaging Devices

Scanners and webcams are examples of SCSI or USB devices used for imaging purposes. Device Control can manage access to these device types.

For all-in-one models that comprise a scanner, a printer, and a memory card reader, there are situations where access to the scanner functionality is denied if Device Control disables the Printer functionality.

LPT/Parallel Ports

Device Control allows access management for dongles, parallel printer ports, and variants like ECB.

Modems/ Secondary Network Access Devices

Network devices that are not connected directly using normal channels are referred to as secondary network access devices. Device Control enables access to these internal or external devices.

  1. Modems belonging to different brands operate differently. Based on the brand, you may need to permit access to the modem port, COM port, or both. Determine the best option for you by experimenting with the settings.
  2. Users who connect through dialup will require a permission rule to be set up for the modem’s Local System account.
  3. The Secondary network access devices/modems type also includes FireWire (IEEE 1394) net adapters. New permissions are applied following a reboot.

Palm Handheld Devices

Use Device Control to control access to this type of device.

Portable Devices

This type includes removable media like digital cameras, MP3 players, portable storage devices, mobile phones, and so forth.

Printers

You can permit or deny access to all print devices with drivers that use the Windows Print Spooler service.

For all-in-one models that comprise a scanner, a printer, and a memory card reader, there are situations where access to the scanner functionality is denied if the Printer functionality is disabled.

PS/2 Ports

Traditional keyboards are connected to the computer through PS/2 ports but nowadays most keyboards rely on USB connections. Blocking all PS/2 ports is an option for an organization that uses only USB mice and USB keyboards. It reduces the risk of attack by PS/2 keyloggers (hardware devices that record keyboard movements and capture typed data, including passwords).

Removable Storage Devices

Removable storage devices are all those devices that are not categorized as floppy or CD/DVD-ROM drive-based devices. Device Control allows access management for this device type, which includes PCMCIA hard drives and USB memory devices such as MP3 players, digital cameras, memory sticks, and so forth.

Removable storage devices also include secondary hard disk drives. If you specify whether a policy is intended for a hard drive or non hard drive, it allows you to choose between secondary hard disk drives and memory keys. In addition, you can restrict access through connection modes like SCSI, PCMCIA, or USB.

RIM Blackberry Handhelds

RIM (Research in Motion) Blackberry devices are mobile phones or handheld computers that are usually connected to a computer through the USB port. With Device Control, you can manage access to these GSM or PDA devices.

Smart Card Readers

Device Control allows access permissions for fingerprint readers and smart card readers, such as eToken.

Tape Drives

You can manage access to internal and external tape drives of any capacity with Device Control.

Device Control cannot control certain backup units that do not use Microsoft- supplied drivers.

User-defined Devices

Some devices, such as web cams, OTEC, HTC, and PDAs (non-Compaq IPAQ USB, non- Palm handheld USB) do not fit into conventional device categories. Device Control allows you to manage access to them by labeling them as user-defined devices.

Windows CE Handheld Devices

Handheld Windows CE devices such as HP iPAQ or XDA (running Windows Pocket PC 2002/2003 OS) connect to the computer through a USB port. Access to these devices can be managed with Device Control.

Wireless Network Interface Cards

During installation of the Device Control agent, you can decide if you want to allow access to a wireless LAN adapter.

Wireless card access is permitted only for those cards that do not require administrator installation privileges or a manufacturer-specific driver.