Blocking USB storage in the domain while having a white list of devices

Question

Hello,

Recently a need appeared to have the external storage blocked in our domain. The problem is, a hard block like “All Removable Storage classes: Deny all access“ is not a good option for us. We would like to have a white list of devices that we are able to connect to the computers, and to have the rest blocked. Is it achieveable through group policies? Addidionally, would it be possible to, for example, for an administrator access prompt to appear every time someone tries to connect an external storage?

Answer 1

Hello Mateusz Nowakowski ,

Thank you for posting in Q&A forum.

To my knowledge, in a domain environment, if you want to restrict the use of removable storage devices but need to whitelist certain devices, it can indeed be achieved through group policy. But the use of storage devices can only be allowed or denied based on their hardware ID.

The following are the basic steps to implement whitelist control for removable storage devices through group policy:

1. Open the Group Policy Editor (for example, by running gpedit.msc).
2. Navigate to Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions.
3. Enable the policy to "Prevent installation of devices not described by other policy settings," and add the Hardware IDs of the devices you wish to allow.
4. Enable the policy to "Allow administrators to override device installation restriction policies," so that administrators can intervene when someone attempts to install an unauthorized device.

If you're hoping to "require administrator access to install a pendrive," unfortunately, this cannot be achieved through GPO.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi @Mateusz Nowakowski •

Yes It's possible to specify a white list through GPO or registre key. I invite you read the following article to get mor details:

Allow Only Specific USB Storage Devices in your Organization Using Group Policy

Allow installation of devices that match any of these device IDs

---

Please don't forget to accept helpful answer