{"id":3987,"date":"2026-06-08T18:06:19","date_gmt":"2026-06-08T15:06:19","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&p=3987"},"modified":"2026-06-08T18:06:19","modified_gmt":"2026-06-08T15:06:19","slug":"how-to-configure-device-control-where-all-of-usb-devices-are-blocked-unless-whitelisted-by-its-hardware-id","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/fi\/support-articles\/how-to-configure-device-control-where-all-of-usb-devices-are-blocked-unless-whitelisted-by-its-hardware-id\/","title":{"rendered":"How to configure Device control where all of USB devices are blocked unless whitelisted by its hardware ID."},"content":{"rendered":"

Issue:<\/h3>\n

How to configure Device control where all the USB devices are blocked unless whitelisted by its hardware ID or InstanceID?\u00a0<\/p>\n

Resolution:<\/h3>\n

You can make rules of various USB Classes where you can set the access level to Block and than make a whitelist rule to allow the specific USB devices by the Instance ID.\u00a0<\/p>\n

To know various Class please check this page,\u00a0<\/p>\n

https:\/\/en.wikipedia.org\/wiki\/USB<\/a>\u00a0(Scroll down and find Device Classes)\u00a0<\/p>\n

Once you have blocked it make another rule to whitelist the specific devices with the instance ID and Hardware ID.\u00a0<\/p>\n

\u00a0<\/p>\n

For Elements Endpoint Protection for Computers and Servers<\/u><\/strong> you can set restrictions on how users can access USB devices (for example, web cams and hard disks) and whether removable mass storage devices are allowed to execute installers.<\/p>\n

To set up Elements Endpoint Protection Device control to disallow all USB mass storage devices:<\/p>\n

    \n
  1. Log in to the Elements Security Center portal: https:\/\/elements.withsecure.com<\/li>\n
  2. Navigate to the Security configurations > Profiles <\/strong>page<\/li>\n
  3. Select the profile that is in use on the devices<\/li>\n
  4. Go to the Device control<\/strong> settings page<\/li>\n
  5. Turn Device control on.\n
      \n
    • Note<\/strong>: If Device control is on, all devices that are connected to the computer are visible on the device page under Connected devices <\/strong>on the Environment > Devices <\/strong>page<\/li>\n<\/ul>\n<\/li>\n
    • Scroll down to the Device access rules <\/strong>table and on the USB Mass Storage Devices <\/strong>row, click on the Access to device <\/strong>column and set it as Block\u00a0<\/strong><\/li>\n
    • Scroll up to the Device filtering rules <\/strong>table and click Add rule <\/strong>and add the Instance ID <\/strong>of the USB storage device you want to allow.\u00a0\n
        \n
      1. You can run with Powershell Get-PnpDevice -class USB | Select name, InstanceID, HardwareID <\/strong>command <\/strong>to get the necessary IDs what you can allow.<\/li>\n<\/ol>\n<\/li>\n
      2. Click Save profile<\/strong><\/li>\n<\/ol>\n

        If you only want to block write or executable access for USB mass storage devices, in the Removable mass storage devices <\/strong>section in the profile settings you can turn off one of the following options:<\/p>\n

          \n
        • Allow write access<\/strong> – when this option is off, users cannot copy files to a removable mass storage device. Removable mass storage devices can only read data.<\/li>\n
        • Allow executables to run<\/strong> – when this option is off, executing files from removable mass storage devices is prevented.<\/li>\n<\/ul>\n

          Note<\/strong>: For USB devices, Device ID can also be viewed with the Windows Device Manager:<\/p>\n

          Device Manager > Disk Drives > USB partition<\/p>\n

          The reason for checking USB partition because is when you insert USB device into a PC it is not necessarily detected as as a single device in Windows, because of the possibility of partitions. So, if some flash drive has several partitions on it, it will be detected as both "USB Mass Storage Device", with every partition presented as a separate 'device' under Disk Drive. This is reflected in Policy Manager alerts and Elements Security Events.\u00a0<\/p>\n

          \u00a0<\/p>\n

          For Business Suite Client Security and Server Security:<\/strong><\/span><\/p>\n

          \u00a0<\/p>\n

          To block USB mass storage devices:<\/p>\n

            \n
          1. Log in to the Policy Manager Console<\/li>\n
          2. Select a host or policy domain from the domain tree<\/li>\n
          3. Go to the Settings <\/strong>tab<\/li>\n
          4. Go to the Windows > Device control <\/strong>settings page<\/li>\n
          5. Enable Device Control by checking the box for Device control enabled<\/strong><\/li>\n
          6. Scroll down to the Device access rules <\/strong>table\u00a0<\/li>\n
          7. In the USB Mass Storage Devices <\/strong>row, change the Access level <\/strong>column to be Blocked<\/strong><\/li>\n<\/ol>\n

            To allow a specific USB device:<\/p>\n

              \n
            1. Click Add <\/strong>on the right side of the Device access rules <\/strong>table<\/li>\n
            2. Set the rule as Active<\/strong><\/li>\n
            3. Enter a Display name for the rule<\/li>\n
            4. Enter the InstanceID of the USB device to the\u00a0Hardware ID <\/strong>column\n
                \n
              1. You can run with Powershell Get-PnpDevice -class USB | Select name, InstanceID, HardwareID <\/strong>to get the necessary IDs.<\/li>\n<\/ol>\n<\/li>\n
              2. Set the Access<\/strong>\u00a0level <\/strong>for the rule to be Full access<\/strong><\/li>\n
              3. Distribute the policy (Ctrl+D)<\/li>\n<\/ol>\n

                Devices can also report device IDs to the Policy Manager:<\/p>\n

                  \n
                1. Log in to the Policy Manager Console<\/li>\n
                2. Select a host or policy domain from the domain tree<\/li>\n
                3. Go to the Settings <\/strong>tab<\/li>\n
                4. Go to the Windows > Device control <\/strong>settings page<\/li>\n
                5. Enable Report installed devices\u00a0<\/strong><\/li>\n
                6. Distribute the policy (Ctrl+D)<\/li>\n<\/ol>\n

                  Now when you select the specific host from the policy domain tree, you can click on the View devices <\/strong>link in the Windows > Device control <\/strong>settings page to view a list of devices.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

                  \u00a0How to configure Device control where all the USB devices are blocked unless white-listed by its hardware ID.\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-3987","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000012859","source_version":2,"source_system":"salesforce","source_date_updated":"2026-06-08 15:06:19","import_hash":"8fe45b0684147fbdabb7a93374af6baeaf8cc190","vanilla_article_id":32710,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/32710-how-to-configure-device-control-where-all-of-usb-devices-are-blocked-unless-whitelisted-by-its-hardware-id","vanilla_kb_id":30,"vanilla_category_id":102,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article\/3987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/media?parent=3987"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/fi\/wp-json\/wp\/v2\/support_article_product?post=3987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}