AllowInstanceIDs registry key not unblocking USB until manual device uninstall

Question

AllowInstanceIDs registry key not unblocking USB until manual device uninstall

shabir magray 0

Hi everyone,

I am building a batch script to manage USB storage policy via Device Installation Restrictions in the registry under HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions.

The global block works fine, but when I attempt to allow a specific drive using AllowInstanceIDs and AllowDenyLayered, Windows keeps the device blocked even after I run gpupdate /force and pnputil /scan-devices.

The drive only works if I manually open Device Manager, uninstall the blocked disk device node, and click "Scan for hardware changes". Once uninstalled, Windows re-detects it and respects the allowlist key.

Is there a command line or PowerShell command to force the PnP Manager to clear this cached restriction flag on the device node automatically without manual steps in Device Manager?

Thank you!

0 comments

1 answer

Your answer

Answer 1

To automate this, remove the existing PnP device node and then force hardware re-enumeration. I'm not aware of command specifically for clearing an internal Device Installation Restrictions cache. pnputil /remove-device removes the device node, and pnputil /scan-devices causes Windows to discover it again and evaluate the current policy during reinstallation.

For a batch script, use:

@echo off set "INSTANCE_ID=USBSTOR\DISK&VEN_......"
echo Removing existing PnP device node... pnputil.exe /remove-device "%INSTANCE_ID%"
if errorlevel 1 ( echo Failed to remove device node. exit /b 1 )
echo Scanning for hardware changes... pnputil.exe /scan-devices
if errorlevel 1 ( echo Hardware scan failed. exit /b 1 )
echo Device re-enumeration completed.

The equivalent PowerShell script is:

$InstanceId = 'USBSTOR\DISK&VEN_......'
Write-Host 'Removing existing PnP device node...' & pnputil.exe /remove-device "$InstanceId"
if ($LASTEXITCODE -ne 0) { throw "Failed to remove device node. PnPUtil exit code: $LASTEXITCODE" }
Write-Host 'Scanning for hardware changes...' & pnputil.exe /scan-devices
if ($LASTEXITCODE -ne 0) { throw "Hardware scan failed. PnPUtil exit code: $LASTEXITCODE" }
Write-Host 'Device re-enumeration completed.'

/remove-device removes the device node from the PnP device tree - it does not uninstall or delete the associated driver package from the Windows driver store. /scan-devices then causes PnP to enumerate the hardware again.

Make sure to use the correct device instance ID for AllowInstanceIDs. You can obtain it with PowerShell, for example:

Get-PnpDevice -Class DiskDrive | Select-Object Status, FriendlyName, InstanceId

or, for USB storage devices:

Get-PnpDevice | Where-Object { $_.InstanceId -like 'USBSTOR*' } | Select-Object Status, FriendlyName, InstanceId

More at PnPUtil command syntax documentation

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin