How to block USB flash drives while allowing other USB devices

Symantec Endpoint Protection Manager 12.1

禁用USB端口但允許使用USB鍵盤和USB鼠標等輸入輸出設備

Situation:

How do you block USB flash drives while allowing other USB devices?

Solution:

In the Symantec Endpoint Protection Manager, open Policies, then click Application and Device Control. Open an existing policy or click Add an Application and Device Control Policy. Click on the Device Control tab. Under the Blocked Devices section click the ADD button and select the USB option. Click the ADD button under Excluded from Blocking and select, one by one, all of the other devices that use USB that should not be blocked (eg: pointing devices, keyboard, cameras, joysticks, HDD, etc. ) Click OK to save the changes and assign policy. Warning: Failure to add device exclusions for critical system devices may lead to system instability or blue screens. Some disk controllers may be addressed using a USB bus and will be blocked, possibly blocking SAN and iSCSI devices. Please test all policies before use in a production environment.