I appreciate your help on this.
Yes I have been using the monitoring tab quite a bit and can see when the rule applies. So far, if the the device IS on the UDLP list and that list has been applied to the connector it works.
What issue are you thinking that I am having? As far as i am concerned, everything is working normally within the natural limitations of the way the rules function per your mentioning that the UDLP list will be queried FIRST so essentially the exceptions I could list (Smartcard reader, etc) have zero affect. Is that not the case? Me wanting to query the list but also exempt machines that are showing 'attach' and 'eventinfo' for *whatever devices i want to not be blocked without explicitly updating the UDLP list is my goal but again it does not seem possible.
Additionally the UDLP and the LEM white list both needing to contain device information in order for the device to NOT be detached seems redundant as I thought they were two separate options for achieving the same result but perhaps this is what you are referring to as far as the 'issue' you mentioned. My real concern is what is going to happen when i start filling in the white-list on the LEM while keeping the UDLP list working and from your previous post about the different scenarios if both have it - it works. Once I get it updated i can eventually only use the LEM's white-list and stop importing.
I went ahead and took your suggestion in anticipation of your response on recreating the rule from scratch (below).
My current User Defined Group.
