Share via

Auto scan usb Windows 11

amartinez_admin 20 Reputation points
2025-02-14T12:50:58.0333333+00:00

In Intune, devices, configurations - I have in place this policy with NO conflict and no scanning happens at all when I insert a usb device (I check event viewer)

Enable Automatic Scanning of Removable Media

Allow Archive Scanning

Allow Behavior Monitoring

Allow Full Scan On Mapped Network Drives

Allow Full Scan Removable Drive Scanning

Allow scanning of all downloaded files and attachments

Allow Realtime Monitoring

Allow Scanning Network Files

Further, an examination of the regedit settings show all the above are in place.

A right-click Microsoft Defender Scan on the usb finds the test malware file

A full scan finds the test malware file

We require a quick scan on usb-insert to find it just like the right click option does.

Microsoft Security | Microsoft Defender | Microsoft Defender for Identity
Windows for business | Windows Client for IT Pros | User experience | Other
Microsoft Security | Intune | Other
0 comments
Answer accepted by question author
  1. Anonymous
    2025-02-17T01:32:33.5966667+00:00

    @amartinez_admin Thanks for posting in our Q&A.

    All the regedit settings are in place means intune deploy this policy successfully. Please understand that intune just deploy policies, and how these policies work is based on themselves, it is not controlled by intune.

    Based on my research, by default, Windows Defender and Defender for Endpoint do not automatically scan removable devices as soon as they are connected to a USB port. Someone has discussed this issue, please refer to the following link:

    https://learn.microsoft.com/en-us/answers/questions/1180595/how-to-have-removable-devices-scanned-as-soon-as-t

    Hope it will give you some ideas.

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    3 people found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.