USB and removable-media controls
Control supported removable devices, stage enforcement, and manage temporary device exceptions.
Device-control policies restrict supported removable-media operations on managed endpoints. They can govern device access where the agent exposes that capability; they do not physically disable every external peripheral.
Configure access
Open Policies → Device control → Create policy. Choose the target group, device class, stable device selector, and action. For supported mass-storage devices, actions are monitor, read_only, or block. Device-specific support appears under Endpoint → Capabilities → Device control; do not apply a write-block requirement to a platform that cannot enforce it.
Start with a pilot and open Endpoints → Device events to identify the devices used for the business task. Select the hardware identifier reported in the event. A drive letter or mount path can change and cannot identify the same physical device reliably. If the event lacks a stable identifier, do not create a device-specific allow rule from its path.
A reported hardware identifier can be spoofed. Scope an allow rule to the intended endpoints and use DLP when the transfer also needs content checks.
Publish and verify
Preview the assignment and publish the revision. Under Policy → Adoption, confirm the pilot received it, then test a permitted read and a denied write using non-sensitive data.
Before relying on the block, read Endpoint → Capabilities → Device control for how the platform handles existing mounts and open files. Follow its re-evaluation procedure and repeat the denied-write test. Files copied before enforcement remain at their destination.
At Policy → Exceptions → Create, choose the specific device and endpoint, business owner, reason, and expiry. A temporary rule must not allow every removable device in the organization. Review adoption and access events when the exception expires.
Recover an incorrect block
Open the policy revision linked from the device event and correct the rule or create an approved exception. After publication, check Policy → Adoption for the endpoint's applied revision and repeat the permitted device operation.
If the device cannot reach management, a recovery administrator can obtain its device-bound instructions at Endpoint → Maintenance → Recovery authorization. Perform those steps locally on the affected device. When it reconnects, compare its applied policy with the console assignment and test access again. Keep the agent's tamper protection enabled during ordinary policy correction.
Data loss prevention can add content-aware restrictions on supported channels; device access alone does not classify the copied data. Retained device events follow privacy and retention controls.