To get one, you can use Powershell and run the command: ::NewGuid(). We'll want the Primary ID to be 'RemovableMediaDevices.' You'll also need a unique GUID.

This doesn't block anything but just specifies the 'Primary ID.' You can find the list of different primary ID's in the documentation. The first XML file we'll need is the Group XML that will specify the type of mass storage. You'll need 2 'group' XML files and 1 'policy' XML file. I like to use Visual Studio Code or Notepad++. You'll also need a text editor to modify the XML files. You can go to the official Github to download samples or I published the XML files I'm using in my own Github. The first thing you'll need to do is download (or create from scratch) some XML files that will be needed to configure your policies. If you prefer to read a tutorial with screenshots, continue on!

In this blog article, I'll show you how to configure the ability to block mass storage devices with an allow list that you can maintain in Intune and Microsoft Defender for Endpoint.įirst off, if you prefer watching video demos, here's a link to a fantastic video that shows you how to configure it. As every security defender knows, you cannot draw a hard line and block EVERY USB mass storage device. A common request from information security teams is the ability to block mass storage devices.

Windows defender usb scan