Managing access to mobile devices
Kaspersky Endpoint Security lets you manage Android and iOS mobile devices. Mobile devices belong to the category of portable devices (MTP). Therefore, to configure access to mobile devices, you must edit the access settings for portable devices (MTP).
When a mobile device is connected to the computer, the operating system determines the device type. If Android Debug Bridge (ADB), iTunes or their equivalent applications are installed on the computer, the operating system identifies mobile devices as ADB or iTunes devices. In all other cases, the operating system may identify the mobile device type as a portable device (MTP) for file transfer, a PTP device (camera) for image transfer, or another device. The device type depends on the model of the mobile device and the selected USB connection mode. Kaspersky Endpoint Security lets you configure individual access rules for mobile devices in the ADB application. In all other cases, Device Control allows access to mobile devices in accordance with portable devices (MTP) access rules, including access to mobile devices in the iTunes application.
Access to mobile devices
Mobile devices belong to the category of portable devices (MTP), therefore the settings for them are the same. You can select one of the following modes of access to mobile devices:
- Allow
. Kaspersky Endpoint Security allows full access to mobile devices. You can open, create, modify, copy, or delete files on mobile devices using the file manager or ADB and iTunes applications. You can also charge the battery of the device by connecting the mobile device to a USB port of the computer.
- Block
. Kaspersky Endpoint Security restricts access to mobile devices in the file manager and ADB and iTunes applications. The application allows access only to trusted mobile devices. You can also charge the battery of the device by connecting the mobile device to a USB port of the computer.
- Depends on connection bus
. Kaspersky Endpoint Security allows connecting to mobile devices in accordance with the USB connection status (Allow
or Block
).
- By rules
. Kaspersky Endpoint Security restricts access to mobile devices in accordance with rules. In the rules, you can configure access rights (read / write) to portable devices (MTP), select users or a group of users that can have access to portable devices (MTP), and configure an access schedule for portable devices. You can also restrict access to devices using the ADB application.
Configuring mobile device access rules
How to configure mobile device access rules in Administration Console (MMC)
How to configure mobile device access rules in Web Console and Cloud Console
How to configure mobile device access rules in the interface of the application
As a result, user access to mobile devices is restricted in accordance with rules. If you have prohibited access to mobile devices in the ADB application, Kaspersky Endpoint Security displays a notification, and ADB does not detect the mobile device.
Trusted mobile devices
Trusted devices are devices to which users that are specified in the trusted device settings have full access at all times.
The procedure for adding a trusted mobile device is exactly the same as for other types of trusted devices. You can add a mobile device by ID or by device model.
To add a trusted mobile device by ID, you will need a unique ID (Hardware ID – HWID). You can find the ID in device properties by using operating system tools (see figure below). The Device Manager tool lets you do this. IDs of portable devices (MTP) and ADB devices are different even for the same mobile device. The ID of a portable device (MTP) may look like this: 15131JECB07440
. The ID of an ADB device may look like this: 6&370DEC2A&0&0001
. Adding devices by ID is convenient if you want to add several specific devices. You can also use masks.
If you installed the ADB application after connecting a device to the computer, the unique ID of the device may be reset. This means that Kaspersky Endpoint Security will identify this device as a new device. If a device is trusted, add the device to the trusted list again.
To add a trusted mobile device by device model, you will need its Vendor ID (VID) and Product ID (PID). You can find the IDs in device properties by using operating system tools (see figure below). Template for entering the VID and PID: VID_18D1&PID_4EE5
. Adding devices by model is convenient if you use devices of a certain model in your organization. This way, you can add all devices of this model.
Device ID in Device Manager