USB Block - Attack Surface Reduction

You can use Device Control to: Block All, Allow Some or Block Some:

From my understanding, you request is to Allow Some: In this case, You will need to

• Block all activities
• Specify generic device IDs
• Exclude the allowed devices
• And Finally, Allow the specific activities.

Refer - https://learn.microsoft.com/en-us/defender-endpoint/device-control-walkthroughs

There can be several reasons why a policy may not work. The steps below will guide you to identify the root cause of the issue.

Verify minimum requirements

is the device E3 or E5 enrolled?

Does the machine have a valid certificate? (If not, the device control policy may not reflect on the endpoint)

• You can validate this by running the following Powershell command on the machine Get-AuthenticodeSignature C:\Windows\System32\wbem\WmiPrvSE.exe
• Check whether the client machine has the policy stored in the Registry
  • If deployed from Intune: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager\Device Control\Policy
• below key value must exist:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdDevFlt\Parameters\EnforcementData\PolicyPackage
  • If this value does not exist, it means there was a problem with retrieving the policy You can aslo Check Policy Application on Devices

You can also check policy Application Using Intune:

• Intune Admin Center:
  1. Go to Devices > All devices.
  2. Select a device and check the Device configuration status.
  3. Verify that the configuration profile with the device control policy is listed as Succeeded. If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.