How to Block USB Drives Using Microsoft Intune Attack Surface Reduction Policies

Why Should Organizations Block USB Drive Access Through Microsoft Intune?

USB drives represent one of the most significant security risks in corporate environments. They can introduce malware, facilitate data exfiltration, and bypass network security controls. Microsoft Intune's Attack Surface Reduction (ASR) policies provide a robust, cloud-based solution for controlling removable storage access across Windows 10 and 11 devices.

This comprehensive guide walks you through implementing USB drive restrictions using Intune's Device Control policies, which leverage Microsoft Defender for Endpoint capabilities to provide granular control over removable storage devices.

What Are the Prerequisites for Implementing USB Blocking in Intune?

Before diving into the configuration process, ensure your environment meets these essential requirements:

• Licensing: Microsoft 365 E5 or equivalent license for full ASR Device Control features
• Device Management: Windows 10/11 devices enrolled in Intune with Microsoft Defender for Endpoint enabled
• Administrative Access: Permissions to access the Intune admin center and configure endpoint security policies
• Group Management: Entra ID (Azure AD) security groups configured for device assignments

How Do You Access and Navigate Microsoft Intune's Attack Surface Reduction Settings?

Begin by accessing the Microsoft Intune admin center through your web browser. Navigate to https://endpoint.microsoft.com and sign in with administrative credentials that have Endpoint security permissions.

Once authenticated, locate Endpoint security in the left navigation panel and click on Attack surface reduction. This section houses all policies related to reducing potential attack vectors, including device control capabilities.

The Attack surface reduction dashboard displays existing policies and provides options to create new ones. Click + Create Policy to begin configuring your USB blocking policy.

What Platform and Profile Settings Should You Choose for USB Device Control?

When creating a new policy, you'll need to specify the target platform and profile type. For USB drive blocking, configure these settings:

• Platform: Windows 10, Windows 11, and Windows Server
• Profile: Device Control

The Device Control profile provides comprehensive options for managing removable storage devices, including USB drives, external hard drives, and other removable media. This profile leverages Microsoft Defender for Endpoint's advanced device control capabilities.

Policy Configuration:
Platform: Windows 10, Windows 11, and Windows Server
Profile: Device Control
Capabilities: Removable storage control, device exceptions, audit mode

How Do You Configure the Basic Policy Information and Naming Convention?

Proper policy naming and documentation are crucial for long-term management. On the Basics tab, provide clear, descriptive information:

• Name: Use a descriptive format like "USB Write Block - [Department/Scope]"
• Description: Include the policy's purpose, scope, and any relevant compliance requirements

Example naming conventions:

Policy Names:
- "USB Write Block - Finance Department"
- "Complete USB Block - Executive Devices"
- "USB Read-Only - General Corporate Devices"

Description Template:
"Prevents [read/write/all] access to USB drives to protect against [data exfiltration/malware introduction]. Applied to [target group]. Compliance requirement: [relevant standard]"

What Are the Different USB Blocking Configuration Options Available?

The Configuration settings tab offers several options for controlling USB device access. Understanding these options helps you choose the appropriate level of restriction:

For most organizations, enabling Removable Disk: Deny Write Access provides an effective balance between security and usability. This configuration allows users to read data from USB drives (such as software installers or documentation) while preventing data exfiltration.

Recommended Configuration for Standard Corporate Environment:
- Removable Disk: Deny Write Access = Enabled
- Removable Disk: Deny Read Access = Not configured
- Other storage options = Not configured

How Should You Assign USB Blocking Policies to Target Groups?

Policy assignment determines which devices receive your USB blocking configuration. Use a phased approach for deployment:

Phase 1: Pilot Testing

• Create a small security group with 5-10 test devices
• Include devices from different departments to test various use cases
• Exclude administrator devices that require USB access

Phase 2: Department Rollout

• Deploy to specific departments based on risk assessment
• Prioritize high-risk areas like finance, HR, and executive teams
• Monitor for user impact and adjust as needed

Phase 3: Organization-wide Deployment

• Expand to all corporate devices
• Maintain exception groups for legitimate business needs

Example Group Structure:
Include Groups:
- "Corporate-Devices-Pilot" (testing)
- "Finance-Department-Devices" (high-risk department)
- "All-Corporate-Windows-Devices" (full deployment)

Exclude Groups:
- "IT-Admin-Devices" (administrative exceptions)
- "USB-Approved-Devices" (business exceptions)

How Do You Monitor Policy Deployment and Force Device Synchronization?

After creating your policy, monitor its deployment status and force synchronization when needed. Intune policies typically deploy within 5-10 minutes but can take up to 8 hours in some cases.

To force immediate synchronization:

1. Navigate to Devices > All devices in the Intune admin center
2. Select target devices and click Sync
3. Monitor the sync status until completion

Use PowerShell on target devices to check and force synchronization:

# Check last sync time
Get-ScheduledTask | Where-Object {$_.TaskName -like "*EnterpriseMgmt*"} | Get-ScheduledTaskInfo

# Force immediate sync (run as administrator)
Get-ScheduledTask | Where-Object {$_.TaskName -like "*EnterpriseMgmt*"} | Start-ScheduledTask

# Verify policy application
Get-MpPreference | Select-Object AttackSurfaceReductionRules_*

Monitor deployment progress through the policy's device status view, which shows successful, failed, and pending deployments across your assigned device groups.

What Methods Can You Use to Test and Verify USB Blocking Functionality?

Thorough testing ensures your USB blocking policy works as expected. Follow this systematic testing approach:

Basic Functionality Test:

1. Insert a USB drive into a test device
2. Attempt to copy a file to the USB drive
3. Verify that write access is denied with an appropriate error message
4. Test read access (if allowed) by opening files from the USB drive

Event Log Verification:

Check Windows Event Viewer for ASR events that confirm policy enforcement:

# View ASR events in Event Viewer
# Navigate to: Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

# PowerShell command to check ASR events
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; ID=1121,1122} -MaxEvents 10 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Device Inventory Verification:

# List connected USB mass storage devices
Get-WmiObject Win32_USBControllerDevice | ForEach-Object {[wmi]($_.Dependent)} | Where-Object {($_.Description -like '*mass*')} | Sort-Object Description,DeviceID | Format-Table Description,DeviceID -AutoSize

# Check removable drives
Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DriveType -eq 2} | Select-Object DeviceID, VolumeName, Size, FreeSpace

How Can You Configure Advanced Settings and Device Exceptions?

Some business scenarios require exceptions to USB blocking policies. Intune's reusable settings feature allows you to create granular exceptions based on device characteristics:

Creating Device Exceptions:

1. Edit your existing Device Control policy
2. Navigate to the Configuration settings tab
3. Click + Add under Reusable settings
4. Create a new setting named "Approved USB Devices"
5. Under Device controller, add specific device identifiers

Identifying USB Device Information:

# Get detailed USB device information
Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DriveType -eq 2} | ForEach-Object {
    $drive = $_.DeviceID
    Write-Host "Drive: $drive"
    
    # Get associated physical disk information
    Get-WmiObject -Class Win32_LogicalDiskToPartition | Where-Object {$_.Dependent -like "*$drive*"} | ForEach-Object {
        $partition = $_.Antecedent
        Get-WmiObject -Class Win32_DiskDriveToDiskPartition | Where-Object {$_.Dependent -eq $partition} | ForEach-Object {
            $diskDrive = $_.Antecedent.Split('=')[1] -replace '"',''
            Get-WmiObject -Class Win32_DiskDrive | Where-Object {$_.DeviceID -eq $diskDrive} | Select-Object Model, SerialNumber, PNPDeviceID
        }
    }
}

# Alternative method for USB device Instance IDs
Get-PnpDevice | Where-Object {$_.Class -eq "DiskDrive" -and $_.Status -eq "OK"} | Select-Object FriendlyName, InstanceId, HardwareID

Exception Configuration Options:

• Instance ID: Specific to individual devices
• Hardware ID: Applies to device models
• Serial Number: Unique device identifier (most reliable)

What Troubleshooting Steps Should You Follow for Policy Issues?

When USB blocking policies don't work as expected, follow this systematic troubleshooting approach:

Verify Prerequisites:

# Check Windows Defender status
Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, IoavProtectionEnabled, AMServiceEnabled

# Verify Defender for Endpoint connectivity
Get-MpComputerStatus | Select-Object AMServiceVersion, AMProductVersion, AntispywareSignatureVersion

# Check ASR rules configuration
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

Common Issues and Solutions:

Advanced Troubleshooting Commands:

# Check Intune management extension status
Get-Service -Name "Microsoft Intune Management Extension" | Select-Object Status, StartType

# Verify device enrollment status
dsregcmd /status | Select-String "AzureAdJoined", "DomainJoined", "WorkplaceJoined"

# Check for conflicting Group Policy settings
Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" -ErrorAction SilentlyContinue

How Do You Monitor Long-term Policy Compliance and Effectiveness?

Ongoing monitoring ensures your USB blocking policies remain effective and don't negatively impact business operations:

Regular Compliance Checks:

• Review device compliance reports weekly
• Monitor user help desk tickets related to USB access
• Analyze security incident reports for USB-related threats

Policy Performance Metrics:

• Deployment Success Rate: Percentage of devices successfully receiving the policy
• Compliance Rate: Devices properly enforcing USB restrictions
• Exception Usage: Frequency of approved device exceptions
• User Impact: Help desk tickets and user feedback

Automated Monitoring with PowerShell:

# Create a compliance check script
$devices = Get-MgDevice -Filter "operatingSystem eq 'Windows'"
foreach ($device in $devices) {
    $compliance = Get-MgDeviceCompliancePolicyDeviceStatus -DeviceId $device.Id
    Write-Output "Device: $($device.DisplayName), Compliance: $($compliance.Status)"
}

# Monitor ASR rule effectiveness
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; ID=1121,1122; StartTime=(Get-Date).AddDays(-7)} | Group-Object Id | Select-Object Name, Count

Regular policy reviews should include:

• Quarterly assessment of business requirements
• Annual review of exception lists and their justifications
• Continuous monitoring of emerging USB-based threats
• User training updates based on policy changes