Back to Blog
    usb-device-control
    block-usb-storage

    USB Device Control: How to Block and Manage USB Storage

    Dustin CollettOctober 26, 2026

    USB device control is a policy on your computers that decides which USB devices may connect, what they may do, and what gets logged. You can block all USB storage, allow only approved drives, or let a device work read-only. For most small businesses, the practical path is a Windows policy, pushed through Group Policy or Microsoft Intune, with Microsoft Defender for Endpoint adding finer rules and reporting where you license it.

    This guide explains how device control works, how to block USB storage on Windows step by step, how to keep exceptions from becoming loopholes, and what to test afterward. We run this for manufacturers, financial firms and professional offices across Southeastern Wisconsin, so the examples lean toward those environments.

    TL;DR

    • USB device control identifies a device when it is plugged in, checks it against your rules, then allows, blocks, limits or logs it.
    • Windows can do this natively: Group Policy for device installation restrictions, Intune for managed fleets, and Defender for Endpoint for allow-lists by hardware properties.
    • The safest design is default-deny for removable storage with a short, documented exception path, not a blanket ban nobody can live with.
    • Blocking is only half the job. Test on a pilot machine, confirm the policy applied, and review the logs on a schedule.
    • Production floors and operational technology need their own rules, because a locked-down office laptop policy can stop a machine tool update.

    Table of Contents

    What USB device control actually does

    A USB port accepts far more than flash drives. Keyboards, headsets, phones, external hard drives, network adapters and charging cables all use it. Device control sits in the operating system or the security agent and answers three questions each time something is plugged in: what is this device, who is using the computer, and does a rule permit it?

    The answer is one of four outcomes: allow, block, allow with limits (such as read-only), or allow and record. That last outcome matters more than people expect. Audit-only mode shows you what your staff really plug in before you break anything.

    Businesses use it for four reasons:

    • Data theft. A 128 GB drive fits in a shirt pocket. Copying a customer list or a set of CAD files takes seconds.
    • Malware. Infected drives carry malicious files into networks that otherwise sit behind firewalls.
    • Compliance. Frameworks and customer contracts increasingly ask how you control removable media.
    • Visibility. Without logs, you cannot answer the question "what left the building on Friday?"

    The goal is control, not punishment. A blanket block with no exceptions pushes people to workarounds such as personal email and consumer cloud storage, which are often worse. Good device control allows what the business needs and stops everything else.

    How to block USB storage on Windows

    You have three practical routes. Which one fits depends on how your computers are managed.

    MethodBest forWhat it controlsReporting
    Group PolicyDomain-joined PCs on a local Active DirectoryDevice installation by class or hardware IDBasic, via event logs
    Microsoft IntuneCloud-managed or hybrid fleetsUSB and removable storage settings pushed to device groupsIntune compliance and policy status
    Defender for Endpoint device controlTeams that need allow-lists and audit trailsAccess by vendor, product, serial number and moreDevice control report and Advanced Hunting

    Option 1: Group Policy

    In the Group Policy editor, the relevant settings live under Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions, as Microsoft documents for device installation. From there you can prevent installation of whole device classes, or target one model.

    To block a single device, you find its hardware ID in Device Manager and add it to the policy that prevents installation of devices matching listed device IDs. That works well when you know the specific offender. It is clumsy as a company-wide approach, because you would be chasing every new drive model.

    For a broad block, use the class-based setting for removable storage and test it before rollout. Apply the policy to an organizational unit containing one pilot computer first, not the whole domain.

    Option 2: Microsoft Intune

    If your computers are enrolled in Intune, you can build a settings catalog policy, choose the USB restrictions, and assign it to a device group. Microsoft walks through the steps in its guide to restricting USB devices with the settings catalog. The assignment step is where mistakes happen: assign to a pilot group first, confirm behavior, then widen it.

    Intune suits businesses with remote staff or a mix of office and home laptops, because the policy follows the device wherever it connects. It also pairs naturally with the identity and Microsoft 365 controls most small businesses already run. If you are still sorting out that foundation, our Microsoft 365 consulting in Wisconsin page explains how we approach it.

    Option 3: Defender for Endpoint device control

    This is the route for default-deny with an allow-list. Microsoft's device control walkthroughs show a policy that denies access to all removable storage and then allows specific devices. Defender identifies devices by properties including device ID, vendor ID, serial number and bus type, and you can deploy the settings through Intune.

    That lets you say something like: all removable storage is blocked, except these company-issued encrypted drives, which are allowed for these users. Serial-number matching is the strongest approach because a lookalike drive from the same vendor will not match.

    The tradeoff is licensing and setup effort. Check which Microsoft plan you own before you design around Defender features.

    Design the policy before you flip the switch

    Most failed rollouts skip the design step. Spend an hour on these decisions first.

    1. Inventory current use. Run in audit mode or review logs for two to four weeks. Learn who uses USB storage and why.
    2. Decide the default. For most small businesses, deny removable storage by default and allow keyboards, mice, headsets and other non-storage devices.
    3. Define who gets exceptions. Maybe accounting needs a bank-approved token, or a production engineer needs to load files onto a CNC controller. Write those down by role, not by favor.
    4. Choose approved media. Company-purchased, encrypted drives with known serial numbers are far easier to allow-list than whatever someone finds in a drawer.
    5. Pick a request path. A short form, an owner who approves, a time limit on the exception. If requests take three days, people will route around you.
    6. Tell people first. A two-paragraph email explaining what changes and whom to ask prevents a flood of help desk tickets on day one.

    The approach matches what security vendors and standards bodies stress: block alone is not a strategy. You need managed endpoints, accurate scoping of which devices are covered, a defined exception path and ongoing testing. A policy on an unmanaged laptop does nothing.

    Testing and monitoring after rollout

    A policy that exists is not the same as a policy that works. After you deploy:

    • Test on a pilot machine. Plug in an approved drive and an unapproved one. Confirm the first works and the second is refused.
    • Confirm the policy applied. On Windows endpoints running Defender, the Get-MpComputerStatus PowerShell command reports the state of device control settings, as Microsoft notes in its walkthroughs.
    • Review the events. Defender's device control report shows audit and policy events, such as a USB drive being mounted or a rule being triggered. Advanced Hunting lets you query the same data.
    • Schedule a review. Monthly is enough for most small teams. Look for repeated blocked attempts from the same user, new device models and exceptions that should have expired.

    NIST's guidance on portable storage media makes the same point from the policy side: technical controls need documented procedures for provisioning, using, storing and sanitizing removable media, plus staff training. See the agency's publication on reducing cybersecurity risks of portable storage media.

    Checking which USB devices are connected right now

    If you need a quick look at a single PC, open Device Manager and expand the Universal Serial Bus controllers and Disk drives sections. For a scriptable view, PowerShell can list present USB devices using the Get-PnpDevice command, as shown in this walkthrough of listing USB devices. That is fine for a spot check. For a whole company, it is the wrong tool: you want central reporting, which is what the device control report or your managed IT provider's monitoring gives you.

    Compliance: where USB control shows up

    USB control rarely appears as its own checkbox. It turns up inside broader requirements about media, auditing and access.

    NIST SP 800-171. Contractors who handle controlled unclassified information, which includes many Wisconsin manufacturers in defense and aerospace supply chains, work against this framework. The revision 1 text requires creating, protecting and retaining audit records so unauthorized activity can be monitored and investigated (requirement 3.3.1, in NIST's excerpt). USB event logs feed that directly. The same framework also expects cryptographic protection for controlled information on digital media during transport and security training for users, so allowing an unencrypted drive is a problem even when it is approved.

    Government practice as a model. The U.S. Department of State's 5 FAM 1560 policy requires that removable media used for file transfers be approved by a configuration control board before use, and that systems be configured to disallow booting from USB or eSATA ports by default. A small business does not need a control board, but the logic scales down well: approve media before it is used, and stop machines from booting from unknown devices.

    Customer and insurer questionnaires. Cyber insurance applications and vendor security reviews commonly ask whether removable media is restricted. A documented policy with log evidence answers that cleanly. Check the exact requirements in your own contracts and with your insurer, because they differ.

    For financial firms, law offices and dental practices, the same pattern applies: your regulator or customer sets the outcome, and USB control plus logs is one of the ways you prove it. Your compliance advisor or attorney should confirm which rules apply to you.

    Manufacturing floors and OT: a different set of rules

    Office policies often collide with the shop floor. A production engineer may legitimately need a USB stick to load a program onto a controller, and an older machine may not support modern management agents at all.

    NIST's portable media guidance for operational technology recommends technical controls such as disabling unnecessary ports, allow-listing device access and encrypting portable storage with FIPS-certified algorithms, along with documented procedures for provisioning and sanitizing media. In practice, that translates to:

    • Dedicated, labeled drives for each machine or cell that never leave the floor.
    • A scanning station that checks every drive before it touches a production system.
    • Physical port blockers on devices that never need USB.
    • A named person who signs drives in and out.

    The same document stresses staff training, because technology only works if people follow the procedure. For more on protecting production environments, see our practical guide to manufacturing cybersecurity and our managed IT for manufacturers page.

    What USB control does not cover

    Blocking USB storage closes one door. Data still leaves through email, cloud drives, personal phones, screenshots and shared links. Malware still arrives through phishing and stolen credentials. Treat USB control as one layer in a larger plan:

    It also helps to understand the wider picture of what data security covers before deciding where USB control ranks among your priorities.

    Perspective: control that people can actually live with

    We see the same failure repeatedly. A business buys a tool, blocks every port on day one, and within a month three managers have been granted "temporary" exceptions that never expire. The policy exists on paper and leaks in practice.

    Our view is that USB control is infrastructure, not a project. It belongs in the same managed stack as patching, monitoring, backup and identity, owned by someone who checks it every month. That is why we deliver a standardized, fully-loaded stack at a fixed cost per user rather than selling device control as a separate add-on. Audit readiness and documentation come with it, so when a customer or insurer asks how you handle removable media, you hand over the policy and the logs.

    We also start in audit mode. Two weeks of data shows who really uses USB storage, and it turns the conversation from "you can't" into "here is the approved way." Staff accept rules that make sense, and owners get a policy that holds.

    , Dustin Collett

    Get USB control set up and kept running

    If you would rather not build and babysit this yourself, we handle it as part of managed IT services for small and mid-sized businesses in West Bend and across Southeastern Wisconsin. Not sure where your gaps are? Start with our IT & Security Assessment, which documents how your endpoints, identity, backups and removable media are handled today and what to fix first. Prefer a quick read first? The free IT risk score takes about 60 seconds.

    FAQ

    Can I block USB storage but still let keyboards and mice work?

    Yes. Device control works by device class or by specific properties, so you can deny removable storage while leaving input devices, headsets and displays alone. Test the policy on a pilot computer so you know a docking station or a smart card reader is not caught by accident.

    What is the difference between blocking USB in Group Policy and using Defender for Endpoint?

    Group Policy controls whether Windows installs a device, by class or hardware ID. Defender for Endpoint device control can set allow and deny rules using properties such as vendor, serial number and bus type, and it reports audit events. Group Policy is simpler for a small domain, while Defender suits teams that need an allow-list and evidence.

    Do USB data blockers work?

    A USB data blocker is a physical adapter that passes power but not data, which protects against hostile charging stations. It does not govern which drives your staff plug into company computers. For that you need software policy on the endpoint.

    What should I do when someone legitimately needs a USB drive?

    Give them a documented exception path. Issue a company-owned encrypted drive, allow-list it by serial number for that user, set an expiration, and log its use. Provide a secure file sharing option so the exception does not become permanent.

    How often should I review USB device control logs?

    Monthly is a reasonable rhythm for most small businesses, and more often right after rollout. Look at repeated blocked attempts, unfamiliar device models and exceptions past their end date.

    Sources