Intune USB device read only but no write policy - possible?

Question

Hi folks

Is it currently possible within Intune via a Configuration Profile to achieve the following:

• Allow read only of USB removable disks and WPD portabledevices
• No write capability - not even BitLocker encryption to the above devices

Not sure if this can be achieved natively with Windows 10 and Intune. If anyone can advise whether this can achieved or not, that would be great. My suspicion is that it would require a 3rd party product.

Environment:

Windows 10 Enteprise 1909 with M365 E5 license

Thanks

Rob

Answer 1

First, always keep in mind that Intune doesn't define or dictate what can or cannot be done in Windows. Intune (for the most part) is simply deploying a policy and it's up to Windows to implement and act upon that policy.

For your question, the Removable Storage Access policies (available in group policy) enable you to configure this in Windows. These policies from what I can see are not available as Windows 10 CSPs at this though and thus aren't configurable directly via the Intune UI.

You could configure these policies manually though using PowerShell and send them to your systems that way.

Answer 2

Hi Bob,

Research and find a setting in Administrative Template device Configuration profile named "Deny write access to removable drives not protected by BitLocker"
may be helpful. After setting this, for removable data drives that are not BitLocker-protected, it will be mounted as read-only. If the drive is protected by BitLocker, it will be mounted with read and write access.

Hope it can help.

Answer 3

Thanks for including a link to the powershell scripts that appears to work.........

Answer 4

Yeah, some sort of general guidance Powershell script example would really help save our already frustrating world of tech, a little bit of time.
Thanks