USB & External Devices
Controlling which removable devices a computer may use, and what happens when one is plugged in.
The two device permissions
Every removable device gets one of four permissions, and you set a default for the computer plus an override for any specific device you want to treat differently.
- Allow — full use of the device, including writing files to it.
- Read only — files can be read from the device but nothing can be written to it.
- View only — files can be opened but not copied off the device.
- Block — the device cannot be used at all.
Setting the default versus one device
The default applies to every device that has no specific rule. If you set the default to Block and then explicitly allow your backup drive, that drive works while everything else stays blocked. This is usually the most useful arrangement — block by default, allow what you need.
What happens when a blocked device is plugged in
The computer is notified and the device does not work. The attempt is recorded so you can see it, which is how you find out someone is trying to copy data out.
Phones and cameras
Devices that transfer photos and files without being a storage drive are handled separately, so you can allow a company phone while still blocking unknown flash drives.
How to use it
- What it does
- A strict setup where only specific devices work.
- Why you would use it
- Stops data leaving the machine through any USB device you have not explicitly approved.
- Where to find it
- Dashboard → Computers → your computer → USB Devices.
- Step by step
-
- Set the default device permission to Block.
- Find the device you do want to allow and change its permission to Allow.
- The change reaches the computer within seconds — no restart needed.
- Check the activity log afterwards to see that other devices are being refused.