Block installation of unknown USB storage devices

Question

Looking for effective way to block unknown disk-on-keys and other USB storage devices.

I used pair of Group Policy:

Prevent Installation of devices not described by other policy settings

Allow installation of devices using drivers that match these device setup classes

The problems:
RDP connections blocked, because RDP display adaptor should be installed.

Bluetooth dongles blocked.

Console cables blocked.

Actually I need block only strange mass storage devices with option to allow some of them. This is why I don't used

Computer Configuration | Administrative Templates | System | Device Installation | Device Installation Restriction because there is no option to except some devices.

Any ideas how to it without third party solutions?

Answer 1

As you’ve noted, the built-in policy doesn’t offer a direct "allow specific devices" option. You should be able to narrow down the devices that can install while blocking others by combining more granular device installation restrictions in Group Policy, with a focus on mass storage devices specifically.

1. Device Installation Restrictions with Exception Rules

Configure Device Installation Restrictions:

• Use Computer Configuration -> Administrative Templates -> System -> Device Installation -> Device Installation Restrictions.
• Enable "Allow installation of devices that match any of these device IDs". You can create a whitelist of device IDs (VID, PID, etc.) for the USB mass storage devices you want to allow. This requires obtaining the specific IDs for the devices you want to allow.
• You can explicitly block all USB storage devices by enabling the following:
  • Prevent installation of devices not described by other policy settings
  • Disable automatic installation of mass storage devices (through other related settings).

2. Use the "Device Setup Classes" for USB Mass Storage To block USB mass storage devices while allowing others (like Bluetooth or keyboard/mouse devices), focus on the Device Setup Classes policy.

• Use Computer Configuration -> Administrative Templates -> System -> Device Installation -> Device Installation Restrictions.
• Enable "Allow installation of devices using drivers that match these device setup classes". Add USB (or more specifically USB\VID_xxxx&PID_xxxx for the devices you wish to allow) to the allowed device setup class.

For blocking mass storage devices, you can block the USB mass storage class and create exceptions for specific IDs.

3. Block USB Mass Storage Devices

• Use Computer Configuration -> Administrative Templates -> System -> Removable Storage Access.
• Enable "All Removable Storage classes: Deny all access" to prevent unauthorized USB mass storage devices from being used on your systems.

4. Use USB Device Filtering

If you are able to identify the devices you want to allow (e.g., by hardware ID, serial number, or manufacturer), you can specify these devices in a Group Policy Preference or Device Installation Policy to allow them while blocking others.

You can also set up Group Policy Preferences for registry keys to specifically block USB mass storage devices while excluding devices you know and want to allow.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin