implementing-usb-device-control-policy

# Implementing USB Device Control Policy ## When to Use Use this skill when: - Restricting USB storage devices to prevent data exfiltration or malware introduction - Implementing device control policies via GPO, Intune, or EDR device control modules - Creating USB whitelists for authorized devices while blocking all others - Meeting compliance requirements for removable media control (PCI DSS, HIPAA) **Do not use** for network-based DLP or cloud storage restrictions. ## Prerequisites - Active Directory GPO or Microsoft Intune for policy deployment - Device Instance IDs of authorized USB devices - EDR with device control module (CrowdStrike, Microsoft Defender for Endpoint) - Understanding of USB device classes (mass storage, HID, printer, etc.) ## Workflow ### Step 1: Inventory Current USB Usage ```powershell # Enumerate currently connected USB devices Get-PnpDevice -Class USB | Select-Object InstanceId, FriendlyName, Status # Query USB storage history from registry Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*" | Select-Object FriendlyName, ContainerID, HardwareID # Collect USB usage across fleet (via EDR or scripts) # CrowdStrike: Investigate → USB Device Activity # MDE: DeviceEvents | where ActionType == "UsbDriveMounted" ``` ### Step 2: Configure GPO Device Control ``` Computer Configuration → Administrative Templates → System → Removable Storage Access - All Removable Storage classes: Deny all access → Enabled (Block read AND write fo...