---
title: "Prevent Bluetooth file transfers using Trellix DLP Endpoint for Windows"
slug: "prevent-bluetooth-file-transfers-using-trellix-dlp-endpoint-for-windows-1"
updated: 2026-11-05T14:30:37Z
published: 2026-11-05T14:30:37Z
canonical: "docs.trellix.com/prevent-bluetooth-file-transfers-using-trellix-dlp-endpoint-for-windows-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prevent Bluetooth file transfers using Trellix DLP Endpoint for Windows

Bluetooth RFCOMM file monitoring/blocking in Trellix DLP Endpoint for Windows monitors, blocks, or prompts users for business justification when transmitting classified/sensitive files over Bluetooth connections. It enables security teams to restrict unauthorized data exfiltration without completely disabling Bluetooth devices. The routine workplace operations such as wireless headsets, mice, and other permitted peripherals continue to work uninterrupted. By establishing policy-based controls over RFCOMM communications on endpoints, you can prevent data transfers while preserving everyday productivity.

## Benefits

- **Targeted Blocking:** Blocks unauthorized OBEX file transfers while maintaining peripheral connectivity.
- **Uninterrupted Workflow:** Keeps wireless operations running without disabling the Bluetooth connection.

## Enable Bluetooth transfer protection

Configure a Removable Storage Protection rule to monitor and block unauthorized Bluetooth file transfers.

> [!WARNING]
> Caution
> 
> When multiple files are transferred at the same time, Trellix DLP Endpoint evaluates the transmission and may examine or block unclassified files if they are handled together with classified data.

#### Activate Bluetooth Transfer Protection in Windows Client Configuration

Prior to configuring rules, turn on **Bluetooth Transfer Protection** within the **Windows Client Configuration** policy. Activating this option enables the agent to evaluate OBEX and RFCOMM communication channels.

1. In Trellix ePO, select **Menu → Policy → Policy Catalog**.
2. From the Product drop-down list, select **Data Loss Prevention**, then select **Windows Client Configuration**.
3. Select a configuration to edit, or click **Duplicate** for the Trellix Default configuration.
4. On the **Operational Mode and Modules** page, select **Bluetooth Transfer Protection**.
5. Click **Apply Policy**.

Create a Removable Storage Protection rule to enforce file transfer blocking over Bluetooth.

1. In Trellix ePO, select **Menu → Data Protection → DLP Policy Manager → Rule Sets**.
2. Select **Actions → New Rule Set**, or edit an existing rule set.
3. Select **Actions → New Rule → Removable Storage Protection** rule.
4. Enter a unique name in the Rule Name field and set the State to **Enabled**.
5. Under **Enforce On**, select **Trellix DLP Endpoint for Windows**.
6. On the **Condition** tab, complete these actions:
  - Select target classifications in the **Classification** field.
  - Select **Bluetooth Transfer** devices in the **Removable Media** field.
7. On the **Reactions** tab, complete these actions:
  - Set the Action to **Block**. Supported reactions are, Monitor, Request Justification and Block-outgoing files.
  - Select a definition in the User Notification field.
8. Click **Save** then click **Apply Policy**.

**Result:**

Trellix ePO pushes the policy to the managed endpoints. When a user attempts to transfer classified files through Bluetooth OBEX, Trellix DLP Endpoint blocks the transfer and displays the notification. Non-file-transfer Bluetooth channels remain operational.

## Terms and Definitions

| Term | Definition |
| --- | --- |
| RFCOMM (Radio Frequency Communication) | A transport protocol that emulates RS-232 serial ports over Bluetooth, enabling structured control and data streams between paired devices. |
| OBEX (Object Exchange) | A high-level communication protocol designed for transferring binary objects such as, files and documents between Bluetooth-enabled endpoints. |
| AFAPR (Application File Access Protection Rules) | A macOS-specific policy framework within Trellix DLP that regulates application-level file access and outbound transfers. |
| Data exfiltration | The unauthorized or improper transfer of sensitive, regulated, or proprietary data from an internal system to an external destination. |