| name | implementing-usb-device-control-policy |
| description | Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.
|
| domain | cybersecurity |
| subdomain | endpoint-security |
| tags | ["endpoint","USB-control","device-control","data-loss-prevention","removable-media"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"] |
Implementing USB Device Control Policy
When to Use
Use this skill when:
- Restricting USB storage devices to prevent data exfiltration or malware introduction
- Implementing device control policies via GPO, Intune, or EDR device control modules
- Creating USB whitelists for authorized devices while blocking all others
- Meeting compliance requirements for removable media control (PCI DSS, HIPAA)
Do not use for network-based DLP or cloud storage restrictions.
Common Misconfigurations & Verification
- Over-broad allow exceptions: an exception keyed only on
VID_xxxx (vendor) or a USB class permits every device from that vendor/class, not the specific approved unit. Pin allow rules to the full Device Instance ID (USB\VID_0781&PID_5583\<serial>) and verify the serial component is present, not a wildcard.
- Device Installation vs. Removable Storage Access confusion: "Prevent installation of devices not described by other policy settings" blocks new installs but does nothing to already-installed drivers; existing devices keep working until removed. Pair it with
Removable Storage Access → All Removable Storage classes: Deny all access for live blocking.
- Blocking all USB breaks HID: denying the whole USB bus kills keyboards/mice and USB-C docks. Scope deny rules to mass storage / WPD, and confirm Thunderbolt and MTP phones are covered too — they often slip past a storage-only rule.
- Read-only assumed = safe: "Deny write access" still allows malware to autorun from the device. Confirm whether read should also be denied for untrusted media.
- Verification: with the policy applied, insert an unapproved USB stick — it must be blocked (Event ID 6416 absent or access-denied, MDE
DeviceEvents shows the deny) — then insert an approved device by full instance ID and confirm it mounts. Test a USB keyboard still works to prove HID wasn't caught.
Prerequisites
- Active Directory GPO or Microsoft Intune for policy deployment
- Device Instance IDs of authorized USB devices
- EDR with device control module (CrowdStrike, Microsoft Defender for Endpoint)
- Understanding of USB device classes (mass storage, HID, printer, etc.)
Workflow
Step 1: Inventory Current USB Usage
# Enumerate currently connected USB devices
Get-PnpDevice -Class USB | Select-Object InstanceId, FriendlyName, Status
# Query USB storage history from registry
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*" |
Select-Object FriendlyName, ContainerID, HardwareID
# Collect USB usage across fleet (via EDR or scripts)
# CrowdStrike: Investigate → USB Device Activity
# MDE: DeviceEvents | where ActionType == "UsbDriveMounted"
