Block USB Drives Using Microsoft Intune Attack Surface Reduction Policies

Open your web browser and navigate to the Intune admin center. Sign in with your administrative credentials that have Endpoint security permissions.

https://endpoint.microsoft.com

Once logged in, navigate to Endpoint security in the left sidebar, then click on Attack surface reduction. This section contains all the policies for controlling device access and reducing potential attack vectors.

Click the + Create Policy button to start creating your USB blocking policy. You'll be presented with platform and profile options.

Configure the following settings:

• Platform: Select "Windows 10, Windows 11, and Windows Server"
• Profile: Choose "Device Control"

Click Create to proceed to the policy configuration wizard.

On the Basics tab, provide essential information about your policy:

• Name: Enter a descriptive name like "Block USB Write Access - Corporate Devices"
• Description: Add details such as "Prevents write access to USB drives to protect against data exfiltration and malware introduction"

Click Next to proceed to the configuration settings.

On the Configuration settings tab, locate the Storage section. Here you'll find the removable disk controls.

For basic USB write blocking, configure:

• Removable Disk: Deny Write Access: Set to Enabled

For complete USB blocking (read and write), you can also enable:

• Removable Disk: Deny Read Access: Set to Enabled

Configuration Example:
- Removable Disk: Deny Write Access = Enabled
- Removable Disk: Deny Read Access = Not configured (allows reading)
- Other storage options = Not configured

Click Next to proceed to assignments.

On the Assignments tab, you need to specify which devices or users will receive this policy. Click + Add groups to select your target groups.

Choose from:

• Device groups: Entra ID security groups containing Windows devices
• User groups: Groups containing users whose devices should receive the policy

For testing, start with a small pilot group:

Example Assignment:
- Include: "IT-Pilot-Devices" (security group with 5-10 test devices)
- Exclude: "IT-Admin-Devices" (admin devices that need USB access)

Click Next to review your configuration.

On the Review + create tab, carefully review all your policy settings:

• Policy name and description
• Platform and profile type
• Configuration settings (USB blocking options)
• Group assignments

If everything looks correct, click Create to deploy the policy.

The policy will now appear in your Attack surface reduction policies list with a status of "Deploying" or "Active".

To speed up policy deployment, force synchronization on target devices. Navigate to Devices > All devices in the Intune admin center.

For each test device:

1. Select the device from the list
2. Click Sync in the device overview
3. Wait for the sync to complete (usually 1-2 minutes)

You can also check sync status using PowerShell on the target device:

# Check last sync time
Get-ScheduledTask | Where-Object {$_.TaskName -like "*EnterpriseMgmt*"} | Get-ScheduledTaskInfo

# Force immediate sync (run as administrator)
Get-ScheduledTask | Where-Object {$_.TaskName -like "*EnterpriseMgmt*"} | Start-ScheduledTask

Monitor deployment status in Endpoint security > Attack surface reduction by clicking on your policy and viewing the device status.

Once the policy is deployed, test the USB blocking functionality on a target device:

1. Insert a USB drive into the test device
2. Attempt to copy a file to the USB drive
3. Verify that write access is denied

Check the Windows Event Viewer for ASR events:

# Open Event Viewer and navigate to:
# Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

# Or use PowerShell to check for ASR events:
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; ID=1121,1122} -MaxEvents 10

You can also verify connected USB devices using PowerShell:

# List USB mass storage devices
Get-WmiObject Win32_USBControllerDevice | ForEach-Object {[wmi]($_.Dependent)} | Where-Object {($_.Description -like '*mass*')} | Sort-Object Description,DeviceID | Format-Table Description,DeviceID -AutoSize

For more granular control, you can create reusable settings with specific device exceptions. Navigate back to your Device Control policy and edit the configuration.

To create exceptions for specific USB devices:

1. In the policy configuration, click + Add under Reusable settings
2. Name the setting (e.g., "Approved USB Devices")
3. Under Device controller, click + Add
4. Select Removable storage
5. Add specific device Instance IDs or serial numbers for exceptions

Find USB device Instance ID using PowerShell:

# Get USB device Instance IDs
Get-WmiObject -Class Win32_LogicalDisk | Where-Object {$_.DriveType -eq 2} | ForEach-Object {
    $drive = $_.DeviceID
    Get-WmiObject -Class Win32_LogicalDiskToPartition | Where-Object {$_.Dependent -like "*$drive*"} | ForEach-Object {
        Get-WmiObject -Class Win32_DiskDriveToDiskPartition | Where-Object {$_.Dependent -eq $_.Antecedent} | ForEach-Object {
            Get-WmiObject -Class Win32_DiskDrive | Where-Object {$_.DeviceID -eq ($_.Antecedent.Split('=')[1] -replace '"','')}
        }
    }
} | Select-Object Model, SerialNumber, PNPDeviceID

Regularly monitor your USB blocking policy's effectiveness through the Intune admin center. Navigate to Endpoint security > Attack surface reduction and click on your policy.

Review the following metrics:

• Device status: Shows successful, failed, and pending deployments
• User status: Displays policy application per user
• Per-setting status: Details which specific settings succeeded or failed

Common troubleshooting steps for policy failures:

# Check Windows Defender status
Get-MpComputerStatus | Select-Object AntivirusEnabled, RealTimeProtectionEnabled, IoavProtectionEnabled

# Verify ASR rules status
Get-MpPreference | Select-Object AttackSurfaceReductionRules_*

# Check device compliance
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntispywareEnabled

If devices show as non-compliant:

1. Verify the device is properly enrolled in Intune
2. Check that Microsoft Defender for Endpoint is installed and running
3. Force a device sync and wait 10-15 minutes
4. Restart the device if necessary