skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-usb-device-control-policy

Implements USB device control policies via GPO, Intune, and EDR platforms to restrict removable media access.

954|172|Updated Mar 13, 2026
Search Tags:#data loss prevention#endpoint security#device control#group policy#intune#removable media#usb control
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-usb-device-control-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-usb-device-control-policy
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/implementing-usb-device-control-policy
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-usb-device-control-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Uncontrolled USB devices on endpoints enable data exfiltration and malware introduction, and ad-hoc blocking often breaks keyboards, docks, or legitimate workflows. This Skill provides a structured workflow to inventory USB usage, deploy device control policies, and verify enforcement without disrupting HID peripherals.

Core Features & Use Cases

  • USB Usage Inventory: Enumerate connected devices and query USB storage history via PowerShell, registry, and EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint).
  • Policy Deployment: Configure Group Policy Removable Storage Access rules, Device Installation Restrictions with approved Device Instance IDs, and MDE Device Control XML policies with VID/PID allowlists.
  • Audit & Monitoring: Track USB events through Windows Event IDs 6416/4663 and MDE DeviceEvents, with monthly reporting on blocked attempts and exceptions.
  • Use Case: A security team needs to meet PCI DSS removable media requirements: block all unapproved USB storage fleet-wide via Intune, whitelist two encrypted SanDisk models by full Device Instance ID, and confirm keyboards and USB-C docks still function.

Quick Start

Help me deploy a USB device control policy that blocks all unapproved removable storage via Group Policy while allowing specific approved devices by Device Instance ID.

Frequently Asked Questions about implementing-usb-device-control-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I block USB storage devices with Group Policy?▼

Enable 'All Removable Storage classes: Deny all access' under Computer Configuration → Administrative Templates → System → Removable Storage Access. For granular control, deny write access on Removable Disks only, and pair with Device Installation Restrictions to allow approved devices by ID.

How to allow specific USB devices while blocking all others?▼

Enable 'Prevent installation of devices not described by other policy settings' plus 'Allow installation of devices that match any of these device IDs'. Pin allow rules to the full Device Instance ID including the serial number, not just VID/PID, so only the specific approved unit works.

Does blocking USB storage also block keyboards and mice?▼

It can if you deny the entire USB bus, since keyboards and mice are USB HID devices. Scope deny rules to mass storage and WPD classes only, and verify after deployment that HID peripherals and USB-C docks still function.

What is the difference between GPO device control and Microsoft Defender device control?▼

GPO Removable Storage Access provides built-in class-level blocking, while MDE Device Control uses XML policies with granular VID/PID groups, access masks, and user notifications. MDE also centralizes USB event telemetry through DeviceEvents for auditing.

Why do already-installed USB devices still work after blocking policy?▼

The 'Prevent installation' setting only blocks new device installs; existing drivers keep working until removed. Combine it with 'All Removable Storage classes: Deny all access' to block live access for devices already present on the endpoint.

When should I not use USB device control policies?▼

Do not use endpoint device control for network-based DLP or cloud storage restrictions, which require separate controls. Also avoid blanket USB denial without an exception process, since legitimate needs like presentations and field data collection require approved encrypted devices.

Related Skills

Explore More Software Engineering Skills→
AxxxxxxaaannAxxxxxxaaann

analyzing-usb-device-connection-history

Parse Windows registry and logs to generate a unified USB device timeline.

Community
Intermediate
starwreckntxstarwreckntx

Data Exfiltration Agent

Simulate data exfiltration via DNS tunneling and HTTPS channels to test DLP controls.

Community
Basic
starwreckntxstarwreckntx

Endpoint Protection Agent

Detect malware and enforce security policies on managed endpoints.

Community
Basic
aroidoaroido

agent-test-writer

Generate Vitest frontend tests for components, hooks, and integration scenarios.

Official
Advanced