In Windows 10 Pro, is there a way to block all USB devices, but allow specific ones?

In particular, I want to allow only one specific USB mass storage device - i.e. one specific vendor model, with a unique serial number.

This article claims that it's possible: https://community.spiceworks.com/how_to/1488-lockdown-usb-to-specific-removable-usb-drives. However it was written in 2010 and the instructions don't seem to work on Windows 10: I couldn't change the permissions of the usbstor.inf file and the machine still mounts previously unseen models of USB sticks.

  • 1
    You can do this with a group policy, how this is done is well documented, have you tried the group policy method? – Ramhound Jul 6 '17 at 11:37
  • @Ramhound You're right. I got it working through group policy, and it's a much cleaner solution (no messing around with system file permissions). – Kal Jul 7 '17 at 14:53

Following @Ramhound's suggestion, I got it working using group policy.

The general direction is documented here: https://technet.microsoft.com/en-us/library/2007.06.grouppolicy.aspx

In particular, the "Prevent installation of removable devices" rule is what I need.

So here's a summary of what I ended up doing:

  1. In Device Manger, uninstall all USB devices that I don't want, including the ones that are currently not connected - there's an environment variable called DEVMGR_SHOW_NONPRESENT_DEVICES that enables the display of installed, but currently disconnected devices; just search the web for "DEVMGR_SHOW_NONPRESENT_DEVICES";
  2. Install the USB device that I want; in this case, a USB mass storage device;
  3. Enable the "Prevent installation of removable devices" rule in Group Policy.

Caveat emptor:

  1. Group policy probably can't effectively block some devices that don't expose a unique serial ID. E.g if a certain vendor model of USB mass storage device doesn't expose a unique serial ID, and you have installed one, then group policy might allow any other instances of the same vendor model to be mounted. I don't have such a model of USB mass storage device with me, so I can't really verify.
  2. As far as I understand, USB device IDs are not signed and thus cannot be verified - i.e. if a USB device claims to be a certain device, with a particular serial ID, there is no way for the computer to tell whether that's true. A bad guy could build a USB device with forged USB device ID and forged serial ID, in order to get it accepted by you computer, though even then.

With all that said, this solution works if you assume that all your devices expose unique serial IDs and that nobody tries to forge a USB device to get it accepted by your computer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.