Forum Discussion

Copper Contributor

Aug 02, 2024

Solved

Blocking USB slots in Intune

Dear Reader, because of security reasons, I want to block all the USB slots of our clients. On different websides I was told to go to Intunes - Devices - Windows - Configuration and create ...

Intune

micheleariis
Aug 02, 2024
Hilmar Hi, to force sync you can use this command:
intunemanagementextension://syncapp

I also recommend this feature if you want the refresh to be done more often:

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/intro-to-config-refresh-a-refreshingly-new-mdm-feature/ba-p/4176921

Administrative templates are mostly used for compatibility with Windows 10; if your devices are Windows 11, it is definitely better to use endpoint security, which is the evolution of administrative templates and allows for more modern device management.

If you want to lock the usbs at startup, you will have to go to work on the bios.
Through Intune, some manufacturer (e.g.Dell), gives the ability to create configuration files and then deploy to devices in a centralized way

https://learn.microsoft.com/it-it/mem/intune/configuration/bios-configuration

I hope I have been helpful to you

micheleariis

MCT

Aug 02, 2024

Hilmar Hi, to force sync you can use this command:

intunemanagementextension://syncapp

I also recommend this feature if you want the refresh to be done more often:

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/intro-to-config-refresh-a-refreshingly-new-mdm-feature/ba-p/4176921

Administrative templates are mostly used for compatibility with Windows 10; if your devices are Windows 11, it is definitely better to use endpoint security, which is the evolution of administrative templates and allows for more modern device management.

If you want to lock the usbs at startup, you will have to go to work on the bios.
Through Intune, some manufacturer (e.g.Dell), gives the ability to create configuration files and then deploy to devices in a centralized way

https://learn.microsoft.com/it-it/mem/intune/configuration/bios-configuration

I hope I have been helpful to you

micheleariis

MCT

Aug 05, 2024

Hi, I usually assign the policy to a group of users\devices where all the company devices\users are present; then I create a security group (devices\users) and assign as exclusion on the policy; keep in mind that even after the sync it takes a bit of time for what concerns the USB ports.
When you have to go to block\allow only certain devices you will have to go and work on the IDs of these; here you can go and block for example all the printers except those with device ID xxxx-xxx-xxxx

Hilmar
Copper Contributor
Aug 06, 2024
yes, I need to be more patient. Thought "synchronise" means "right now" :o)
20 minutes after sync the test client made a sound, telling me the USB stick is unblocked again.
- micheleariis
  MCT
  Aug 06, 2024
  Unfortunately, there are cloud times in the way 🙂
  I hope over time they improve this as well; I'm not saying it has to be in real time but at most 5 minutes on these configurations