When writing to a device that uses the MTP/PTP/WPD drivers, the data control event gets logged to the local PC, but does not get submitted t
When writing to a device that uses the MTP/PTP/WPD drivers, the data control event gets logged to the local PC, but does not get submitted to the console. On later versions of Windows, the MTP driver seems to be used by default, so that even flash drives, which traditionally used the mass storage driver, are instead using MTP and data control events are only accessible from the local PC. Our only solution at this time is to block PCs with later versions of Windows from writing altogether, which will be unfeasible as these newer versions become more prevalent. When can we expect this anomaly to be resolved?
Windows seems to be moving towards using their WPD driver for all removable storage devices. With the requested feature, we will continue to be able to log data control events to the console and
retrieve them in report form from SQL Reporting Services.
Without this feature, as Windows eradicates support for Mass Storage, we will lose insight into DLP-related events.