Removing Group Policy from a PC

JenRG 41 Reputation points
2026-09-02T14:37:14.1466667+00:00

Our server is Server 2003 R1. Most of the PCs connected to it are running Win 7. We're upgrading and want to donate the PCs. However, someone who worked on the system years ago set up a very stringent policy that no one can undo and that will affect the ability of others to use the PCs.

The problem is that somewhere is group policy is a restriction that specifies whichever brand of keyboard and mouse and whichever ports they are first plugged into are what can be used for life. That means if you first plugged in a Microsoft Keyboard and Mouse, that is the brand that you always have to use. If the keyboard and mouse break, you have to take note of what USB ports they are plugged into. If they are plugged into the wrong ports, they work in the BIOS but not in windows.

Since we're donating these, we don't want the new end user to have to deal with this. Is there a way to just strip the policy off of the PC so that it works with whatever you plug in?

Windows for business | Windows Client for IT Pros | Directory services | Deploy group policy objects
0 comments

4 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-02T14:37:35.1433333+00:00

    Yes. The supported path is to remove the device-installation restrictions that were applied to the computer, because these policies are computer-based and affect all users on that PC.

    Recommended approach:

    1. Verify which policies are still applied.
      • Run gpresult /h gpresult.html.
      • Open rsop.msc.
      • Confirm whether the restriction is coming from domain GPO, local GPO, or another management source.
    2. Check the Device Installation restriction area.
      • Open Local Group Policy Editor or the applicable GPO.
      • Go to: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions
      • Review policies such as:
        • Prevent installation of devices using drivers that match these device setup classes
        • Prevent installation of devices that match these device IDs
        • Prevent installation of devices that match any of these device instance IDs
        • Prevent installation of removable devices
      • Remove or disable the restrictive entries.
    3. Check for allow/deny conflicts.
      • Device installation control applies to computer configuration, not user configuration.
      • Policies that prevent installation take precedence over policies that allow installation.
      • If the old configuration used allowlisting by device instance ID or setup class, that can cause only the originally approved keyboard/mouse or USB path to work.
    4. Refresh policy.
      • Run gpupdate /force.
      • Restart the PC.
    5. If the machine is no longer in the domain, clear lingering local policy settings carefully.
      • Residual policy can remain in local policy/registry areas even after domain removal.
      • Registry-based policy settings are commonly stored under:
        • HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices
        • HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR
      • Relevant values to review include Deny_Read, Deny_Write, and Start.
      • Warning: deleting policy-related registry keys is a risky operation and can affect other device or security settings. Use it only after confirming the restriction is no longer being reapplied by GPO.
    6. If specific devices were previously installed under a restrictive allowlist, remove the restriction first, then retest with different keyboard/mouse devices and USB ports.
      • The guidance for allowlisting issues notes that previously installed devices and drivers can affect results.

    For donation preparation, the cleanest result is:

    • unlink or stop applying the old domain GPO,
    • remove the local/device-installation restriction policies on the PC,
    • run gpupdate /force,
    • restart and test with different USB ports and different keyboard/mouse hardware.

    If the restriction still persists after that, the remaining cause is most likely a computer-level Device Installation Restriction policy or related registry setting still being applied locally.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. JenRG 41 Reputation points
    2026-09-02T15:42:55.9866667+00:00

    There are no device restrictions in gpresult /h gpresult.html. In group policy editor, those items are not configured.

    I'm in RSOP, but need ore details on what to look at.

    Need more detailed instructions made for someone who know how to get into group policy editor, event viewer, etc., but doesn't know what to look for.

    Was this answer helpful?

    0 comments
  3. Daphne Huynh (WICLOUD CORPORATION) 1,305 Reputation points Microsoft External Staff Moderator
    2026-09-03T07:12:55.86+00:00

    Welcome to Microsoft Q&A!

    Thank you for taking the time to provide these details.

    Based on your description, this behavior sounds less like a standard user policy and more like a Device Installation Restriction policy that was configured to allow only specific device IDs, device instance IDs, or device classes. In environments where these policies have been heavily customized, Windows may only recognize the originally installed keyboard and mouse, sometimes even when connected to specific USB ports. As a result, replacement devices can work during POST/BIOS but stop functioning once Windows loads.

    Since gpresult does not show any obvious device restrictions and the corresponding settings appear as Not Configured in Group Policy Editor, I would recommend investigating further through Resultant Set of Policy (RSOP), Event Viewer, and the registry.

    1. Review Device Installation policies in RSOP

    Run: rsop.msc

    Then navigate to: Computer Configuration→Administrative Templates→System→Device Installation→Device Installation Restrictions

    Pay particular attention to the following settings:

    • Prevent installation of devices that match any of these device IDs
    • Prevent installation of devices that match any of these device instance IDs
    • Prevent installation of devices using drivers that match these device setup classes
    • Prevent installation of removable devices
    • Prevent installation of devices not described by other policy settings
    • Allow installation of devices that match any of these device IDs
    • Allow installation of devices using drivers that match these device setup classes

    Even if the original GPO is no longer visible or currently shows as Not Configured, RSOP can help identify the effective policy settings that were applied to the computer.

    2. Check Device Setup logs in Event Viewer

    Open Event Viewer and browse to:

    Applications and Services Logs→Microsoft→Windows→DeviceSetupManager→Admin

    Look for events containing messages such as:

    • "blocked by PnP restriction policy"
    • "installation prevented by policy"
    • References to device IDs (VID/PID values)

    These events can often indicate exactly which policy, or restriction prevented the device from being installed.

    3. Examine the registry

    Device installation restrictions are commonly stored under:

    HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions

    Check for entries such as:

    • DenyUnspecified
    • AllowDeviceIDs
    • DenyDeviceIDs
    • AllowDeviceClasses
    • DenyDeviceClasses

    If these values are populated, they may be enforcing restrictions even if the original Group Policy is no longer easy to locate.

    4. Consider a clean installation before donation

    Because these systems are running Windows 7 and will be donated, the simplest and most reliable approach may be to:

    • Remove the computers from the domain.
    • Back up any data that needs to be retained.
    • Perform a clean Windows installation (or factory recovery if available).

    This removes domain policies, local policies, device restriction settings, and legacy hardware configurations, helping ensure the recipients can use standard keyboards, mice, and USB devices without encountering these restrictions.

    5. If you plan to keep the existing installation

    • Generate a full Group Policy report: gpresult /h C:\gp.html
    • Review the Computer Configuration → Administrative Templates → System → Device Installation section carefully.

    You may also want to export the registry key mentioned above and verify whether any restriction settings remain.

    Based on the symptoms you described, my initial suspicion would be a historical Device Installation Restrictions configuration using device instance IDs, or a "deny all except approved devices" policy that was implemented years ago and has remained in effect.

    Reference: Manage Device Installation with Group Policy | Microsoft Learn

    I hope this helps point you in the right direction. If you find this information helpful, please consider clicking Accept Answer.

    Thank you for using Microsoft Q&A.

    Was this answer helpful?

    0 comments
  4. JenRG 41 Reputation points
    2026-09-08T20:53:53.9066667+00:00

    Go to: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

    HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions

    I don't have any device installation directory on this machine. I tried gpresult /h gpresult.html but it returned no results concerning device installation. I even ran gpupdate /force but did not get any different results.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.