Chapter 15 – Device Control (USB, Bluetooth, Camera & Removable Storage)

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 15 – Device Control (USB, Bluetooth, Camera & Removable Storage)

Learning Objectives

Learn how to secure endpoint devices using Group Policy by controlling USB storage, Bluetooth, cameras, microphones, personal hotspots, Internet Connection Sharing (ICS), and device installation.

1. Why Device Control Matters

Device control reduces the risk of malware, data theft, unauthorized peripherals, and accidental data leakage. It is commonly required by ISO 27001, PCI DSS, HIPAA, and other security standards.

2. USB Storage Control

GPO Path: Computer Configuration → Administrative Templates → System → Removable Storage Access. Configure policies to deny read, write, or all access to removable storage devices.

3. Allow Keyboard & Mouse but Block USB Drives

Use Device Installation Restrictions together with Removable Storage Access to allow standard HID devices while preventing USB mass storage devices.

4. Device Installation Restrictions

GPO Path: Computer Configuration → Administrative Templates → System → Device Installation → Device Installation Restrictions. Restrict installation by device IDs, device classes, or removable devices.

5. Bluetooth Control

Disable Bluetooth through Group Policy or device installation restrictions where organizational policy requires it.

6. Camera & Microphone

Disable camera and microphone using Administrative Templates and App Privacy policies when devices are not required.

7. Personal Hotspot & Internet Connection Sharing

Disable Internet Connection Sharing (ICS) and prevent users from sharing mobile data connections in managed environments.

8. BitLocker To Go

Require BitLocker encryption for approved removable drives before allowing write access.

9. PowerShell

Get-PnpDevice
Get-Disk
Get-Volume
Get-BitLockerVolume
Disable-PnpDevice (use carefully)
Enable-PnpDevice

10. Troubleshooting

Verify GPO scope, run gpupdate /force, review gpresult /h, check Device Manager, confirm policy precedence, review Event Viewer, and validate hardware IDs.

11. Best Practices

Allow only approved USB devices, use BitLocker To Go, audit device usage, document approved exceptions, and review policies regularly.

12. Enterprise Scenario

A finance department allows only encrypted USB drives, blocks Bluetooth file transfers, disables webcams on shared desktops, and prevents Internet Connection Sharing on company laptops.

13. Interview Questions

How do you block USB storage but allow keyboard and mouse? What is the difference between Device Installation Restrictions and Removable Storage Access? How do you disable personal hotspots using GPO?

14. Practical Lab

Create a Device Control GPO, block USB storage, allow keyboards and mice, disable Bluetooth, force policy update, and verify using Device Manager and gpresult.

Common Device Control Policies

Policy

Recommended

GPO Path

All Removable Storage Classes

Deny All Access

System > Removable Storage Access

Removable Disks: Deny Write

Enabled

System > Removable Storage Access

Device Installation Restrictions

Enabled

System > Device Installation

Prevent Installation of Removable Devices

Enabled

Device Installation Restrictions

Disable Bluetooth

As Required

Device Installation / Vendor Policy

Disable Camera

As Required

Windows Components > Camera

Disable Microphone

As Required

Windows Components > App Privacy

Disable Internet Connection Sharing

Enabled

Network > Network Connections

Microsoft Learn References

Removable Storage Access Policies

Device Installation Policies

BitLocker To Go

Windows Camera Privacy

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more