deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-18 20:03:40 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #3765 from MicrosoftDocs/Dansimp-usb-device

Browse Source 
Update control-usb-devices-using-intune.md
This commit is contained in:
Kelly Baker
2020-09-10 15:09:11 -07:00
committed by GitHub
parent 13d67b944b e194630ed6
commit 878ecf0d4e
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
windows/security/threat-protection/device-control/control-usb-devices-using-intune.md
View File

@ -8,7 +8,6 @@ ms.pagetype: security
ms.localizationpriority: medium ms.localizationpriority: medium
ms.author: dansimp ms.author: dansimp
author: dansimp author: dansimp
ms.date: 10/04/2019
ms.reviewer: dansimp ms.reviewer: dansimp
manager: dansimp manager: dansimp
audience: ITPro audience: ITPro
@ -23,7 +22,7 @@ Microsoft recommends [a layered approach to securing removable media](https://ak
1. [Discover plug and play connected events for peripherals in Microsoft Defender ATP advanced hunting](#discover-plug-and-play-connected-events). Identify or investigate suspicious usage activity. 1. [Discover plug and play connected events for peripherals in Microsoft Defender ATP advanced hunting](#discover-plug-and-play-connected-events). Identify or investigate suspicious usage activity.
2. Configure to allow or block only certain removable devices and prevent threats. 2. Configure to allow or block only certain removable devices and prevent threats.
1. [Allow or block removable devices](#allow-or-block-removable-devices) based on granular configuration to deny write access to removable disks and approve or deny devices by USB vendor IDs, product IDs, device IDs, or a combination. Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices. 1. [Allow or block removable devices](#allow-or-block-removable-devices) based on granular configuration to deny write access to removable disks and approve or deny devices by using USB device IDs. Flexible policy assignment of device installation settings based on an individual or group of Azure Active Directory (Azure AD) users and devices.
2. [Prevent threats from removable storage](#prevent-threats-from-removable-storage) introduced by removable storage devices by enabling: 2. [Prevent threats from removable storage](#prevent-threats-from-removable-storage) introduced by removable storage devices by enabling:
- Microsoft Defender Antivirus real-time protection (RTP) to scan removable storage for malware. - Microsoft Defender Antivirus real-time protection (RTP) to scan removable storage for malware.
@ -98,35 +97,37 @@ In this example, the following classes needed to be added: HID, Keyboard, and {3
![Device host controller](images/devicehostcontroller.jpg) ![Device host controller](images/devicehostcontroller.jpg)
If you want to restrict to certain devices, remove the device setup class of the peripheral that you want to limit. Then add the device ID that you want to add. To find the vendor or product IDs, see [Look up device vendor ID or product ID](#look-up-device-vendor-id-or-product-id). If you want to restrict to certain devices, remove the device setup class of the peripheral that you want to limit. Then add the device ID that you want to add. Device ID is based on the vendor ID and product ID values for a device. For information on device ID formats, see [Standard USB Identifiers](https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers).
To find the device IDs, see [Look up device ID](#look-up-device-id).
For example: For example:
1. Remove class USBDevice from the **Allow installation of devices using drivers that match these device setup**. 1. Remove class USBDevice from the **Allow installation of devices using drivers that match these device setup**.
2. Add the vendor ID or product ID to allow in the **Allow installation of device that match any of these device IDs**. 2. Add the device ID to allow in the **Allow installation of device that match any of these device IDs**.
#### Prevent installation and usage of USB drives and other peripherals #### Prevent installation and usage of USB drives and other peripherals
If you want to prevent the installation of a device class or certain devices, you can use the prevent device installation policies: If you want to prevent the installation of a device class or certain devices, you can use the prevent device installation policies:
1. Enable **Prevent installation of devices that match any of these device IDs**. 1. Enable **Prevent installation of devices that match any of these device IDs** and add these devices to the list.
2. Enable **Prevent installation of devices using drivers that match these device setup classes**. 2. Enable **Prevent installation of devices using drivers that match these device setup classes**.
> [!Note] > [!Note]
> The prevent device installation policies take precedence over the allow device installation policies. > The prevent device installation policies take precedence over the allow device installation policies.
The **Prevent installation of devices that match any of these device IDs** policy allows you to specify a list of vendor or product IDs for devices that Windows is prevented from installing. The **Prevent installation of devices that match any of these device IDs** policy allows you to specify a list of devices that Windows is prevented from installing.
To prevent installation of devices that match any of these device IDs: To prevent installation of devices that match any of these device IDs:
1. [Look up device vendor ID or product ID](#look-up-device-vendor-id-or-product-id) for devices that you want Windows to prevent from installing. 1. [Look up device ID](#look-up-device-id) for devices that you want Windows to prevent from installing.
![Look up vendor or product ID](images/lookup-vendor-product-id.png) ![Look up vendor or product ID](images/lookup-vendor-product-id.png)
2. Enable **Prevent installation of devices that match any of these device IDs** and add the vendor or product IDs to the list. 2. Enable **Prevent installation of devices that match any of these device IDs** and add the vendor or product IDs to the list.
![Add vendor ID to prevent list](images/add-vendor-id-to-prevent-list.png) ![Add vendor ID to prevent list](images/add-vendor-id-to-prevent-list.png)
#### Look up device vendor ID or product ID #### Look up device ID
You can use Device Manager to look up a device vendor or product ID. You can use Device Manager to look up a device ID.
1. Open Device Manager. 1. Open Device Manager.
2. Click **View** and select **Devices by connection**. 2. Click **View** and select **Devices by connection**.
@ -135,11 +136,11 @@ You can use Device Manager to look up a device vendor or product ID.
5. Click the **Property** drop-down list and select **Hardware Ids**. 5. Click the **Property** drop-down list and select **Hardware Ids**.
6. Right-click the top ID value and select **Copy**. 6. Right-click the top ID value and select **Copy**.
For information on vendor and product ID formats, see [Standard USB Identifiers](https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers). For information about Device ID formats, see [Standard USB Identifiers](https://docs.microsoft.com/windows-hardware/drivers/install/standard-usb-identifiers).
For information on vendor IDs, see [USB members](https://www.usb.org/members). For information on vendor IDs, see [USB members](https://www.usb.org/members).
The following is an example for looking up a device vendor ID or product ID using PowerShell: The following is an example for looking up a device vendor ID or product ID (which is part of the device ID) using PowerShell:
``` PowerShell ``` PowerShell
Get-WMIObject -Class Win32_DiskDrive | Get-WMIObject -Class Win32_DiskDrive |
Select-Object -Property * Select-Object -Property *