A common request from information security teams is the ability to block mass storage devices. As every security defender knows, you cannot draw a hard line and block EVERY USB mass storage device. E...
Updated Jun 08, 2022
Version 2.0
Blog Post
Glenn Van Rymenant, ajawzero, thank you for taking a look. Glenn Van Rymenant, I have tried via local path and network path and in both times I can see the path of the files getting written into each respective registry entry. For example:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Device Control\Policy Groups with a value of \\network\share\groups.xml and likewise for policy. We were able to duplicate this using a local path like C:\defender\policies\<repsective file>.xml for each entry.
We are not seeing the parsed output itself in \HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager, as I'm led to believe it should be written (according to the excellent YouTube link that Andy provided in this post, although they deployed it via intune and I'm using Group Policy) which is where I believe the problem is. We are using an updated Win10 machine and a fully updated Defender version. -Thanks again