How to block USB flash drives while allowing other USB devices

Symantec Endpoint Protection Manager 12.1

禁用USB端口但允许使用USB键盘和USB鼠标等输入输出设备

Situation:

How do you block USB flash drives while allowing other USB devices?

Solution:

In the Symantec Endpoint Protection Manager, open Policies, then click Application and Device Control. Open an existing policy or click Add an Application and Device Control Policy. Click on the Device Control tab. Under the Blocked Devices section click the ADD button and select the USB option. Click the ADD button under Excluded from Blocking and select, one by one, all of the other devices that use USB that should not be blocked (eg: pointing devices, keyboard, cameras, joysticks, HDD, etc. ) Click OK to save the changes and assign policy. Warning: Failure to add device exclusions for critical system devices may lead to system instability or blue screens. Some disk controllers may be addressed using a USB bus and will be blocked, possibly blocking SAN and iSCSI devices. Please test all policies before use in a production environment.