Implementing USB Device Control Policy

When to Use

Use this skill when:

• Restricting USB storage devices to prevent data exfiltration or malware introduction
• Implementing device control policies via GPO, Intune, or EDR device control modules
• Creating USB whitelists for authorized devices while blocking all others
• Meeting compliance requirements for removable media control (PCI DSS, HIPAA)

Do not use for network-based DLP or cloud storage restrictions.

Prerequisites

• Active Directory GPO or Microsoft Intune for policy deployment
• Device Instance IDs of authorized USB devices
• EDR with device control module (CrowdStrike, Microsoft Defender for Endpoint)
• Understanding of USB device classes (mass storage, HID, printer, etc.)

Workflow

Step 1: Inventory Current USB Usage

# Enumerate currently connected USB devices
Get-PnpDevice -Class USB | Select-Object InstanceId, FriendlyName, Status

# Query USB storage history from registry
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*" |
  Select-Object FriendlyName, ContainerID, HardwareID

# Collect USB usage across fleet (via EDR or scripts)
# CrowdStrike: Investigate → USB…