Use Cases and Best Practices

The following examples show how to combine Class GUIDs and Vendor IDs in Device Control policies to achieve common outcomes.

Use Case 1: Block all USB devices, including devices already connected (keyboard, mouse, dongle)

Add both of the following Class GUIDs as blocked classes:

• {36fc9e60-c465-11cf-8056-444553540000} – USB
• {88bae032-5a81-49f0-bc3d-a4ff138216d6} – USBDevice

If a USB device, such as a mouse or dongle, was already connected before the block policy took effect, it will not be blocked immediately. To enforce the block on an already-connected device, unplug and reconnect the device, or restart the endpoint.

If a customer reports that an existing USB device is still functioning despite a block rule, advise them to either remove and reconnect the device, or reboot the machine.

Use Case 2: Block only USB storage devices while allowing all other USB device types

Add the following Class GUID as a blocked class:

• {4d36e967-e325-11ce-bfc1-08002be10318} – DiskDrive

This reliably blocks USB mass storage devices without affecting other USB peripherals.

Use Case 3: Block all USB storage devices except a specific vendor's device

1. Add {4d36e967-e325-11ce-bfc1-08002be10318} as a blocked class.
2. Add a separate rule to allow the specific Vendor ID for the exempted USB storage device.

Verified working with two distinct USB mass storage devices.