This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 91%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
In the context of using Intune, I'm interested in implementing a security policy specifically related to USB flash drives. My objective is to restrict access to all USB flash drives except for a particular one that is deemed necessary for certain operations within our organization. I've explored Intune's policy settings and would appreciate guidance on configuring a policy that effectively blocks all USB flash drives but permits the use of a single, specified flash drive. This nuanced approach aligns with our security measures while ensuring operational efficiency. Could you please provide step-by-step instructions or insights on achieving this configuration within the Intune platform?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 35%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EZM%3C/text%3E%3C/svg%3E)
@MoTaar,Thanks for posting in Q&A.
From your description, I know you want to set up a policy that will block all USB flash drives but allow one specific USB flash drive.
Based on my research, I found that you can block all USB flash drives but allow one specific USB flash drive using Administrative Templates via Intune.
Please refer to the following article:
Hope this can be helpful.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hello,
the article you provided is not talking about allowing one USB flash drive. but allowing one USB device (Like camera, mouse or other). it's different as they have different GUID you can easily allow these devices by allowing their GUID.
In my case I want to allow two secured USB flash drives. and please know that all USB flash drive have the same GUID.
Any other hint please?
@MoTaar,Thanks for your update.
Based on my research, you can refer the link below to allow specific USB flash drives via Intune.
https://networkingmania.com/allow-only-authorized-usb-devices-using-intune/
Non-official, just for reference.
@MoTaar,Hope things going well.
If there is any update, feel free to contact me.
@ZhoumingDuan-MSFT As I want to allow only 2 flash drives I allowed the 2 by device ID and added the hardware ID as in the document but it didn't work. I still can't access the flash drives allowed.
Any hint please?
@MoTaar,Thanks for your update.
To clarify this issue, we suggest that you can check the information below.
1.Some USB flash drives have multiple GUIDs, and it's common to miss some GUIDs in your policy settings. As a result, a USB device that's allowed in your settings, might be blocked on the device. Please be sure GUID of the USB flash drive is correct.
2.If the GUID of the USB flash drive is correct, you can go to the targeted device to check whether is there existed some related errors in Event Viewer. Location: Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin
Thanks for your understanding. If there is any update, feel free to let me know.
@ZhoumingDuan-MSFT Can you please provide more details where I can find the GUID specified for each flash drives, because under device description in device manager I tested with hardware ID and GUID that are there for couple of flash drives and it's not working. Also the GUID is the same for them all.
@MoTaar,Thanks for your time.
You can refer the link below to get the correct GUID of USB flash drives.
Or you can go to Control Panel > Hardware > Click Device Manager > Find the USB flash drive > Right click it and click Properties > Find Details and change Property to Class GUID > It will be displayed in 'value' section.
Hope this can be helpful. If there is any update, feel free to contact me.
ZhoumingDuan-MSF Thank you for getting back.
Please know that the Class GUID I see there is the GUID for all flash drives, so when I allow it I am allowing all the flash drives not only the two secured ones that I want to allow.
@MoTaar,Hope you having a nice day.
You can refer the method mentioned in the link below to find the USB drive GUID.
https://itexpertly.com/how-do-i-find-my-usb-guid/
Non-official, just for reference.
Or you can refer the method mentioned in the link to achieve your end goal.
Hope this can be helpful.
Thank you @ZhoumingDuan-MSFT , The first is not providing what I am looking for. and the second, I tried to adjust it to my end goal but it's not working. Because you can't disable only flash drives, the policy disables all usb drives.
@MoTaar,Hope things going well.
Based on my research, I found that the policy in Intune that will just allow a class of USB drives instead of specific ones. Therefore, we suggest that you can contact Windows support to check if there exist related settings on Windows that can allow specific USB drives.
Thanks for your kind understanding.
Thank you @ZhoumingDuan-MSFT , I already have a ticket open and still in progress. I'll let you know if a solution is found.
@MoTaar,Thanks for your time.
I am waiting for your update.