Field Effect will generate this ARO when a removable drive is attached to a monitored endpoint.
The "Removable Drive Detected" ARO is generated per host/drive combination. This mean that plugging the same drive into a different endpoint will generate a new ARO. Plugging a different drive into the same host will also generate a new ARO.
Dismissing this ARO will only prevent future AROs when plugging the same removable drive into the same endpoint. Plugging in a different removable drive into the same host OR the same removable drive into a different endpoint a new ARO will be generated.
Resolving this ARO will only acknowledge this alert. Plugging the removable drive back into the endpoint will trigger the alert.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article