1

We blocked USB ports on most of the devices using Intune. However, a subset of users requires USB access due to their job scope which requires them to copy images from their cameras to their PCs. Is there a way we can restrict users from copying any other file formats other than images to the workstation from their USB ports?

If this can't be done, is there a secure way of allowing the users to copy files from a USB and make sure they can't execute them?

Improve this question
2
  • If your goal is to prevent users from introducing new executables onto your system, mount their removable media, home directory, and anywhere else they can write to as "noexec". Just because a file IS a valid image doesn't mean it is not (or does not contain) a valid shell script or binary executable.
    – Ben Voigt
    Nov 25, 2022 at 19:08
  • en.wikipedia.org/wiki/…
    – Ben Voigt
    Nov 25, 2022 at 19:09

1 Answer 1

Reset to default
1

As of this writing, I don't think Intune has that feature. For your second question, you may apply the following device control policies:

  • Set all removable media to be read-only
  • Disallow program execution from removable media
  • Restrict all devices from specific vendors
  • Restrict specific devices identified by vendor ID, product ID, and serial number

See details here

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .