How to Block USB Drives With Group Policy - USB Blocker (2024)

Get My Free Trial Learn More

How to Block USB Devices With AccessPatrol

With AccessPatrol, blocking USB devices is as simple as a few clicks.

1. Open the CurrentWare Console and select AccessPatrol
   
2. Select the group(s) of computers or users you would like to control; AccessPatrol can control USB devices based on groups of user accounts or specific groups of computers.
3. Under the AccessPatrol tab, select Device Permissions
   
4. Under Storage Devices, you can set unique access permissions for USB, CD/DVD, Floppy, Tape, External HDD, Firewire, SD Card, and MM Cards.

5. For granular control over each device: Under Access Permissions set the desired level of restriction (Full Access, Read Only, No Access)
6. To restrict all devices: Click “All Devices” and select the desired level of restriction.
7. Click Apply to save your changes

How to Use Group Policy to Block All Removable Media Devices

Create a group policy object to store the policy you wish to impose in your domain.

1. Launch the Group Policy Management tool on the domain controller
2. Right-click Group Policy Objects, click New
3. Enter a name for the GPO and click OK
4. Right-click the policy and click Edit.

   Adding Policies to the Group Policy Object

5. Group Policy Management Editor
6. Navigate to Computer Configuration Policies > Administrative Templates > System > Removable Storage Access
7. Right-click on All Removable Storage classes: Deny all access, click Edit.
8. Click Enabled and click Apply and then OK

   Linking the Group Policy Object

9. Right-click on the OU
10. Click Link an Existing GPO
11. Select the GPO you created and click OK

    Updating the Group Policy

12. The last step is to update the group policy using the command line gpupdate /force.

How to Block Specific Devices With AccessPatrol

With AccessPatrol, blocking specific USB devices is as simple as a few clicks.

1. Open the CurrentWare Console and select AccessPatrol
   
2. Select the group(s) of computers or users you would like to control; AccessPatrol can control USB devices based on groups of user accounts or specific groups of computers.
3. Under the AccessPatrol tab, select Device Permissions
   
4. Click on the exact device classes that you’d like to restrict; within each class of peripherals you can selectively disable specific device types.

5. Under Access Permissions set the desired level of restriction (Full Access, Read Only, No Access)
6. Click Apply to save your changes

How to Allow (Whitelist) Approved Devices With AccessPatrol

With AccessPatrol’s Allowed List you can block USB devices and other peripherals while allowing specific authorized removable media devices.

1. Connect the desired USB device to any computer that has a CurrentWare Client installed
2. Open the CurrentWare Console
   
3. Select the folder with the computers or users you would like to control
4. Under the AccessPatrol tab, select Allowed List
   
5. Click “Add From Available Devices”
6. Choose a device from the Vendor ID, Serial Number and/or PNP Device ID lists
   
7. Click on Add to Allowed List, then click OK

Administrators can use AccessPatrol’s Device Allowed List to establish a list of devices that their end-users can use on company devices, even when USB ports are disabled.

You can choose to allow devices by the following identifiers:

• Vendor ID
• Serial number
• PNP device ID

Device whitelisting is configured on a per-folder basis. Devices that are added to the allowed list for a given folder will apply to any computers that are in the specified folder. AccessPatrol’s allowed list supports USBs, External Hard drives, Imaging devices, and portable devices.

Note: Allowing a device by serial number is fully compatible with Windows 10. For Windows 7 or 8, some newer models of USB devices may not support this feature. Instead of allowing by serial number, it will allow all devices from the same vendor and model.

How to Use Group Policy to Block Only Some Removable Media Devices

1. In the Local Group Policy Editor (gpedit.msc) browse to the following location: User Configuration > Administrative Templates > System > Removable Storage Access
2. For each media type you’d like to control, enable Deny Read Access, Deny Write Access, or Both. With this method you can control CD/DVD, Custom Classes, Floppy Drives, Removable Disks, Tape Drives, and WPD Devices.
3. Apply the GPO to the Users or OUs that you want to restrict

NOTE: This feature doesn’t work in N editions of Windows 10 Pro.

How to Prevent Specific Files From Being Transferred From USB Ports With AccessPatrol

AccessPatrol allows you to prevent specific files from being transferred to external devices based on their filename or file extension.

1. Open the CurrentWare Console
   
2. Select the computers or users you would like to control
3. Under the AccessPatrol tab, select Block File Transfers
   
4. Under Enter File Name or Extension, type in the desired extension (CSV, BAK, CAD, etc) or file name (client-list, archive, etc) that you would like to block
5. Click Add, then click Close
6. Click Apply to Clients and then click OK

How to Audit USB Device Usage With AccessPatrol

With AccessPatrol, blocking USB devices is as simple as a few clicks.

1. Open the CurrentWare Console and select AccessPatrol
   
2. Select Device Reports, then select the Report Type, Computers/Users, Reporting Period, and other options for your USB activity report.
   
3. Click Run Report to generate a report that is populated with data that meets the parameters you set.

How to Monitor the Use of Removable Storage Devices in Group Policy

Microsoft has released instructions on monitor the use of removable storage devices with group policy.

If you configure this policy setting, an audit event is generated each time a user attempts to copy, move, or save a resource to a removable storage device.

Auditing USB device usage in this way involved manually combing through event logs in search of specific event IDs, such as event 4663, which logs successful attempts to write to or read from a removable storage device.

How to Temporarily Allow Blocked USB Devices With AccessPatrol

AccessPatrol can grant temporary access to blocked devices using it’s access code generator.

Administrators and authorized managers can use the generator to produce a single-use code that provides users with a set duration where the computer’s USB ports are no longer disabled by AccessPatrol.

The access code is unique to each computer that you generate for and the computers do not need to be connected to the internet to use it. So long as the CurrentWare client is installed on the employee’s computer they can be provided with temporary access to USB devices.

1. Generate a temporary access code
   

• Open the CurrentWare Console
• Select the computers or users you would like to provide temporary USB device access to
• Click “Access Code Generator”
• Choose the expiration date and duration of the access code
• Click Generate to create a temporary access code

2. Activate the temporary access code from the employee’s computer

• Have the employee open the Control Panel
• Set “View By” to large icons or small icons
• Click “Grant access to endpoint devices”
• Have the employee enter the temporary access code into the dialogue box, then click “Unlock”

How to Bypass GPO USB Blocking

Group Policy does not support temporarily bypassing GPOs for a set period of time.

To temporarily allow access to USB devices you will need to manually disable the GPO and manually re-enable it when the end-user no longer requires access to USB devices.

To do this, open the the Group Policy Management Console (GPMC), right click the USB blocking GPO under the OU and uncheck the option “Link Enabled”.

To reenable the GPO, simply repeat the process and recheck “Link Enabled”

Get the FREE Template