Forum Discussion
Solved
Blocking USB slots in Intune
Dear Reader, because of security reasons, I want to block all the USB slots of our clients. On different websides I was told to go to Intunes - Devices - Windows - Configuration and create ...
Hilmar Hi, to force sync you can use this command:
intunemanagementextension://syncapp
I also recommend this feature if you want the refresh to be done more often:
Administrative templates are mostly used for compatibility with Windows 10; if your devices are Windows 11, it is definitely better to use endpoint security, which is the evolution of administrative templates and allows for more modern device management.
If you want to lock the usbs at startup, you will have to go to work on the bios.
Through Intune, some manufacturer (e.g.Dell), gives the ability to create configuration files and then deploy to devices in a centralized wayhttps://learn.microsoft.com/it-it/mem/intune/configuration/bios-configuration
I hope I have been helpful to you
Hi, I usually assign the policy to a group of users\devices where all the company devices\users are present; then I create a security group (devices\users) and assign as exclusion on the policy; keep in mind that even after the sync it takes a bit of time for what concerns the USB ports.
When you have to go to block\allow only certain devices you will have to go and work on the IDs of these; here you can go and block for example all the printers except those with device ID xxxx-xxx-xxxx
When you have to go to block\allow only certain devices you will have to go and work on the IDs of these; here you can go and block for example all the printers except those with device ID xxxx-xxx-xxxx
yes, I need to be more patient. Thought "synchronise" means "right now" :o)
20 minutes after sync the test client made a sound, telling me the USB stick is unblocked again.
20 minutes after sync the test client made a sound, telling me the USB stick is unblocked again.
- Unfortunately, there are cloud times in the way 🙂
I hope over time they improve this as well; I'm not saying it has to be in real time but at most 5 minutes on these configurations