chazzy2501 Posted February 17, 2016 Posted February 17, 2016 Argh, I have restricted device installation enabled on all curric PCs. This works well (as devices I don't know can't be installed on Curric PCs.) However I'm supposed to be allowed to add devices that are an exception to this thus the Microbit. I've added a handful of GUIDs and device classes and GPO still insists that the install is blocked by GPO!!! Anyone else have difficulty? or know how to troubleshoot this?
robmal Posted February 17, 2016 Posted February 17, 2016 Can you add an exception by device PID and or VID? I think I have the details for the micro:bit somewhere.... we had to do this with our Safend USB encryption software that would not cope with micro:bits being attached to any of our PCs
chazzy2501 Posted February 17, 2016 Author Posted February 17, 2016 I've added the class ID for the drive "USBSTOR\DiskMBED____DAPLINK_VFS_____0.1_" and the Device ID's (storage and software device) {4d36e967-e325-11ce-bfc1-08002be10318} and {eec5ad98-8080-425f-922a-dabf3de3f69a}. I still get my custom Violation warning... I don't know how to troubleshoot the issue? I can't find an event log that says device blah with guid blah was prevented or anything similar? Just that it was blocked by policy....
kearton Posted February 23, 2016 Posted February 23, 2016 I've added the class ID for the drive "USBSTOR\DiskMBED____DAPLINK_VFS_____0.1_" and the Device ID's (storage and software device) {4d36e967-e325-11ce-bfc1-08002be10318} and {eec5ad98-8080-425f-922a-dabf3de3f69a}. I still get my custom Violation warning... I don't know how to troubleshoot the issue? I can't find an event log that says device blah with guid blah was prevented or anything similar? Just that it was blocked by policy.... Did you manage to get any further with this? I suspect I'm going to be in the same boat very shortly... :/
kearton Posted February 24, 2016 Posted February 24, 2016 Which group policy setting(s) are you using to try and do this please? (e.g is it Administrative Templates\System\Removable Storage Access or something else?) I'm particularly interested in where you're adding your list of exceptions... ?
kearton Posted February 25, 2016 Posted February 25, 2016 Our students cannot use any USB removable storage because we have it denied as per my last post above. I think I found where you were adding exceptions. Because of the above deny, I've had to override this on a particular OU, but then only allow specific micro:bit deviceIDs. But it's still not working... students using PCs in this OU can now see USB storage appearing in "My Computer" when they plug them in, but get "Access Denied" when trying to open them - including the micro:bit Is this the same problem you are having, @chazzy2501 ?
kearton Posted February 25, 2016 Posted February 25, 2016 I found what was causing the access denied, but now the students can access ANY usb removable storage. I think I was barking up the wrong tree above with regards to the exceptions above... this blocks INSTALLATION but not use of, yes? So I'm back to square one. I can find where to BLOCK stuff (Administrative Templates\System\Removable Storage Access) but not where I can allow any exceptions Has anyone got any ideas please? @chazzy2501? (I'm surprised there aren't a load of people on here in the same situation... either I'm an early adopter and ahead of the pack on this one, or most of you allow students to use USB anyway so aren't suffering this problem?)
pete Posted February 25, 2016 Posted February 25, 2016 (edited) ^ We're in the same boat, but our test (just 3) microbits only turned up last week and the actual class sets are anyone's guess. I'll admit I spotted your post and thought "brilliant, I'll see how he gets on before I start working on that". Edited February 25, 2016 by pete 1
kearton Posted February 26, 2016 Posted February 26, 2016 ^ We're in the same boat, but our test (just 3) microbits only turned up last week Yeah we only got 3 too. I think it was the same for everyone. But I immediately called "dibs" on 1 so I could begin testing. I'm beginning to wonder if I can do what I want/need to do by using GPO alone, but I'll keep looking. We have Impero and can allow access to only certain USB devices using that, but (1) that increases our reliance on the product and I'd rather avoid this if I could get away with doing it in GP, and (2) I'd need to add every individual micro:bit individually as an exception because they all have unique ID numbers.
chazzy2501 Posted February 29, 2016 Author Posted February 29, 2016 I have it working now: Under Computer/policies/administrative templates/system/device installation restrictions/ Allow installation of devices that match any of these Device IDs: USB\VID_0D28&PID_0204\9900023431864E45006C10130000005C00000000CC4D28BD USB\VID_0D28&PID_0204&REV_1000 USB\VID_0D28&PID_0204 USBSTOR\DiskMBED____DAPLINK_VFS_____0.1_ USBSTOR\DiskMBED____DAPLINK_VFS_____ USBSTOR\DiskMBED____ USBSTOR\MBED____DAPLINK_VFS_____0 MBED____DAPLINK_VFS_____0 USBSTOR\GenDisk GenDisk STORAGE\Volume No further settings needed (of course this gpo only work in conjunction with (Prevent installation of devices not described by other policy settings) same path as above. if you don't already use this policy be aware that it will affect all new devices including usb kbd and mice even if you only move them between ports. it will however not affect any existing installs. Driver restrictions and windows updates were all left unconfigured. 2
pete Posted February 29, 2016 Posted February 29, 2016 Hmm, we're using the "if it looks like storage, block it, if it's a peripheral allow it" options. Will have a poke about to see if I can amalgamate the two.
fiza Posted May 5, 2016 Posted May 5, 2016 I have it working now: Under Computer/policies/administrative templates/system/device installation restrictions/ Allow installation of devices that match any of these Device IDs: USB\VID_0D28&PID_0204\9900023431864E45006C10130000005C00000000CC4D28BD USB\VID_0D28&PID_0204&REV_1000 USB\VID_0D28&PID_0204 USBSTOR\DiskMBED____DAPLINK_VFS_____0.1_ USBSTOR\DiskMBED____DAPLINK_VFS_____ USBSTOR\DiskMBED____ USBSTOR\MBED____DAPLINK_VFS_____0 MBED____DAPLINK_VFS_____0 USBSTOR\GenDisk GenDisk STORAGE\Volume No further settings needed (of course this gpo only work in conjunction with (Prevent installation of devices not described by other policy settings) same path as above. if you don't already use this policy be aware that it will affect all new devices including usb kbd and mice even if you only move them between ports. it will however not affect any existing installs. Driver restrictions and windows updates were all left unconfigured. @chazzy2501 - Can you tell me which devices the top IDs represent? If you allow "USBSTOR\GenDisk" doesn't that allow the installation of any USB storage device?
chazzy2501 Posted May 17, 2016 Author Posted May 17, 2016 yes, "USBSTOR\GenDisk" would allow any device with that Id but as no device would only have that singular reference it would still fail to install. Without this no usb storage device could be installed. the same as gendisk and storage/volume, without those the device would install but not mount.
Simes1982 Posted July 17, 2023 Posted July 17, 2023 Hi. I am in a similar boat. We have all removable storage blocked. Which one in the list is the Microbit ID. Was it set to allow by hardware ID?
.thumb.jpeg.c4b2ea4e027981376480a5ab518033b7.jpeg)
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now