The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Trellix FRP client events

Published on Sep 12, 2026

2 minute(s) read

Enforcement of Trellix FRP policies generates client events, which include the Event ID and appropriate information related to the event.

Removable media events

Event types

Event ID	Event	Definition
20500	Removable Media Device Insert Event	This event is reported whenever any type of removable media is inserted in the client. Event severity: 0
20501	Removable Media User Response Event	This event is reported whenever the user clicks Yes or No in the Removable Media Format Message window. Event severity: 0
20502	Removable Media Initialization Start Event	This event is reported whenever the user clicks Initialize or Cancel in the Removable Media Initialization window. Event severity: 0
20503	Removable Media Initialization End Event	This event is reported when initialization is complete. Event severity: 4
20504	Removable Media Device Ejection Event	This event is reported whenever any type of removable media is ejected from the client. Event severity: 0
20509	Removable Media Device Upgrade Event	This event is reported whenever the removable media is being upgraded to support large file sizes (> 4GB). Event severity: 0
20521	Removable Media Application Upgrade event	This event is reported when the removable media application is upgraded.
20559	Removable Media Authorization event is either successful or failure	This event is reported when the user's Removable Media Authorization is either successful or failure.
20560	Removable Media Recovery event is either successful or failure	This event is reported when the user's Removable Media Recovery is either successful or failure.
20561	Removable Media Authentication event is either successful or failure	This event is reported when the user's Removable Media Authentication Change is either successful or failure.

20553 & 54 Event ID are replaced with 20559 (removable media authentication/authorization)
20555 & 56 Event ID are replaced with 20560 (RM recovery)
20557 & 58 Event ID are replaced with 20561 (RM authentication details change)

Event details

Information type	Definition
Event ID	Event ID number
System	User information (DomainName\UserName) Time-stamp
Initialization	Initialization state (Failed, Canceled, Successful) Backup state (None, Failed, Canceled, Successful) Time taken for initialization in seconds Time taken for backup in seconds Backup size in GB Size of protected part (only when initialization has completed successfully, in GB)
Device	Size (in GB) File system of device (FAT32, NTFS, EERM) Note File system for devices with new container format (support for files > 4 GB) are shown as FAT32; devices with legacy container are shown as EERM. Vendor name Product name Exempted (Yes, No, Unknown) Protected (Yes, No, Unknown) USB and CD/DVD media encrypted by either onsite only access or offsite access are both considered protected devices. They appear in both Trellix FRP queries as protected media. Note Any new events sent from the Trellix FRP client to ePO - SaaS will have an updated media status.
Event specific fields	User response — Valid for events 20501 and 20502 only

Was this article helpful?