If I want to block/unblock USB devices, I run in cmd:
:block
reg add "HKLM\SYSTEM\CurrentControlSet\services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
:unblock
reg add "HKLM\SYSTEM\CurrentControlSet\services\USBSTOR" /v Start /t REG_DWORD /d 3 /f
What I want is:
generates a whitelist of connected usb devices (any usb, includes keyboard, usb storage, mouse, etc). (solved with wmic path Win32_USBControllerDevice get * > usb.txt)
lock/unlock all usb devices, except whitelist. In linux can be done with udev. I have no idea how it is done in Windows.
Note: Please. I prefer to use batch/wmic/regedit/cmd etc, instead USBDeview or other GUI solution. I'm also not interested in solutions based on Powershell
My Research to solve the problem: I found a colection of scripts based Devcon. There is one called RenewUSB.bat. This script remove all USB devices and then rescan for new ones. It could eventually serve as a starting point for what I want.
To download devcon in this Microsoft Old link. To obtain list drivers for all USB devices with commands:
%windir%\system32\devcon.exe DriverFiles =USB > usb.txt
%windir%\system32\devcon.exe find USB\* > usb.txt
%windir%\system32\devcon.exe find *VID* > usb.txt
PD: Most usb have the identifier "VID" and "USB". Example:
USB\VID_1C4F&PID_0002&MI_01\6&1578F7C2&0&0001 : Input device USB
HID\VID_1C4F&PID_0002&MI_00\7&2B89365C&0&0000 : Keyboard device HID
To block/unblock (specific device of usb.txt):
USB\VID_13FE&PID_1D00\5B7912980144 : USB storage device
%windir%\system32\devcon.exe disable *VID_13FE*
%windir%\system32\devcon.exe enable *VID_13FE*
To block/unblock all usb devices
%windir%\system32\devcon.exe disable *VID* *USB*
%windir%\system32\devcon.exe enable *VID* *USB*
Sometimes devcon does not disable all usb. Only a few. Example:
USB\VID_1C4F&PID_0002&MI_01\6&1578F7C2&0&0001 : Disabled
HID\VID_1C4F&PID_0002&MI_00\7&2B89365C&0&0000 : Disable failed
In this case, no solution. Only replace the command "disable" by "remove".
%windir%\system32\devcon.exe remove *VID* *USB*
But devcon is not a permanent solution for locking and unlocking devices (like reg add which it is). The test is that we can lock a usb device and then run bash script renewusb_2k.bat, and we will see that the script reinstall the usb drivers again and the locked usb device becomes accessible again. So devcon is not the solution to my request.
Thanks in advance
Update:
There are already solutions that do this. You can vote to close this question