How to Allow or Prevent the installation of devices by DeviceClassID or DeviceInstanceID on Windows

Users can manage device installation on computers that you manage, including which devices they can and cannot install. This stops users from installing devices on a “prohibited” list and only enables users to install devices on an “approved” list.

Purpose

The purpose of this knowledge article is to provide a guide on how to allow or prevent the installation of devices by DeviceInstanceIDs using the SureMDM USB Media Control profile.

Prerequisites

• To find the Device class IDs and Device instance IDs, click here.
• Before starting the configuration, please ensure that the device is enrolled into SureMDM through Windows EMM.

 Steps

Step 1: To allow the installation of devices by DeviceClassIDs

1. Log into the SureMDM console.
2. Go to Profiles and select Windows. Further, click Add.
3. Enter the profile name, select USB Media Control, and click Configure.

NOTE: Expand the options below to enable and disable the particular options.

4 Enable the preloaded devices like Audio Devices, Mouse/Keyboards, USB Printers, USB Storage, and Smart Cards to allow all the devices mentioned based on the desired use case.

5. Enter the DeviceClassID in the format “USB\Class_xx.” 

6. Click on Add(+) in the Additional USB DeviceClassIDs. (Users can add multiple DeviceClassIDs to allow specific classes of USB devices.)

7. Enable the Block all other devices not listed above option to prevent access to other USB devices that are not mentioned in the profile.

8. Save the profile and deploy it on the Windows devices on which you want to allow specific devices by their class IDs.

Step 2: To prevent the installation of devices by DeviceClassIDs

1. Enable the preloaded devices like Audio Devices, Mouse/Keyboards, USB Printers, USB Storage, and Smart Cards to Prevent all the devices mentioned based on the desired Use Case.

2. Enter the DeviceClassID in the format “USB\Class_xx”. 
3. Click on Add(+) in the Additional USB DeviceClassIDs. (Users can add multiple device class IDs to prevent specific classes of USB devices)

4. Uncheck the Block all other devices not listed above option to prevent access to other USB devices that are not mentioned in the profile.

5. Save the profile and deploy it on the Windows devices on which you want to prevent specific devices by their class IDs.

Step 3: To allow the installation of devices by DeviceInstanceIDs

1. Enter the DeviceInstanceID in the Allow Installation of Devices by DeviceInstanceIDs section.
2. After entering the ID, click Add (+).
3. The user can enter multiple DeviceInstanceIDs to allow specific devices to be supported by Windows.
4. Enable the Block all other devices not listed above option to prevent access to other USB devices that are not mentioned in the profile.

5. Save the profile and deploy it on the Windows devices on which you want to prevent specific devices by their DeviceInstanceIDs.

Step 4: To prevent the installation of devices by DeviceInstanceIDs

1. Enter the DeviceInstanceID in the Prevent Installation of Devices by DeviceInstanceIDs section.
2. After entering the ID, click Add (+).
3. The user can enter multiple device instance IDs to prevent specific devices from being supported by Windows.

4. Uncheck the Block all other devices not listed above option to prevent access to other USB devices that are not mentioned in the profile.

5. Save the profile and deploy it on the Windows devices on which you want to prevent specific devices by their DeviceInstanceIDs.

Need help? CONTACT US