Disable USB Ports Via Defender for Endpoint (Device Control)

Question

I am trying to disable USB ports on certain systems via USB device control. However, I can't seem to find a clear way to do this (I'm not too sure what the prerequisites are)? For example, in this article (https://thewindowsupdate.com/2021/12/16/block-usb-in-microsoft-defender-for-endpoint-and-intune/) it appears that you have to 1.) Have the Defender for Endpoint agent installed and 2.) You have to have your system managed via Intune. My question is, what if you had the Defender agent installed but you used SCCM or have co-managed systems?

Answer 1

Hi,

Thanks for posting in Microsoft MECM Q&A forum.

Per my experience, we can use Group Policy or Intune to manage USB devices. For more information, please refer to below guides:
Manage USB Devices on Windows Hosts
MEM – All thing about USB Drive Management and Troubleshooting

Thanks for your time. Have a nice day!

Best regards,
Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I must say that the documentation on the Microsoft Learn site is not so clear, but I think this document from Peter van der Woude makes it much easier to understand: https://www.petervanderwoude.nl/post/controlling-devices-connected-to-windows-devices/
The article assumes that you are using Microsoft Endpoint Manager but doing this via another whay like Active Directory Group Policies will be similar.