When the Device Control policy for Sophos Anti-Virus for Mac is changed from Allow to Deny for Optical Drives or Removable Storage, currently plugged-in devices are ejected. Desktop notification and management events for this change are not sent.
All attached devices must be re-mounted when the Device Control policy changes. This means that if the policy changes to now block a device, and that device is already attached, then it will be ejected.
First seen in
Sophos Anti-Virus for Mac OS X