Block USB Storage Only Keyboards Printers and Scanners Keep Working
USB is a connector, not a device. Target the storage class only - pen drives and external disks close, while keyboards, printers and scanners on the same ports keep working.
Technical AnshuManageEngine Device Control PlusFor IT admins
Watch the full video - Device Control Plus setup shown step by step on screen
"Block USB" is the request every admin hears, and it hides a trap: USB is a connector, not a device. The same port carries the pen drive you fear and the keyboard, mouse, printer, scanner and barcode reader your office runs on. Block the port and you have secured the office by shutting it down. The correct target is the storage class - and ManageEngine Device Control Plus, the tool in the video, is built exactly around device classes and ports, so you can close the storage door while everything else keeps working.
Device Classes - What Gets Blocked and What Does Not (Example)
Storage class - restricted
Pen drive / USB mass storageBlockedDENY
External hard diskBlockedDENY
Memory card readerRead onlyLIMITED
Other classes - untouched
Keyboard and mouse (HID)WorkingALLOW
Printer and scannerWorkingALLOW
Webcam and headsetWorkingALLOW
Illustration of class-based control. The point: the port stays alive, the storage class is what closes.
1
Understand the Classes on One PC
Windows itself sorts every plugged device into a class. The ones that matter for this job:
USB mass storage - pen drives and external hard disks. This is the class that carries data away. Restrict this one.
Portable devices (MTP) - phones and tablets presenting their storage. Separate class, separate decision - covered in the phone guide in this series.
Human interface devices - keyboards, mice, barcode scanners. Never include these in a storage policy.
Printers and imaging - printers and scanners. Leave alone unless you have a specific print-control project.
In Device Control Plus you build the policy around these device types and ports, then apply it to users, groups or computers - so the accounts floor and the reception PC can follow different rules.
2
Choose Block, Read Only, or Allow - Per Group
Storage control is not one switch. Use the three levels deliberately:
Block - the default for unknown storage on most PCs. The device does not open at all.
Read only - staff can open and view files from a drive but cannot copy office files onto it. Right for roles that receive data, like a front desk receiving documents.
Allow with audit - full use, but every plug-in and file action is recorded. Right for the few roles whose job is moving data, where blocking would simply stop the work.
File access control in Device Control Plus works at this level - including blocking copies from removable media and limiting transfers by file type and size. A middle path many offices use: allow the trusted drive, but block archive files and files above a set size, so one drive cannot quietly hold the whole file server.
3
Test on One PC Before the Whole Office
Apply the new policy to a single test PC - ideally your own.
Plug in: an unknown pen drive (must block), the office trusted drive (must work), a keyboard, a printer, a phone (must behave as your phone rule says).
Check the console report shows each event with the right action.
Only then widen the policy group by group.
Five plugs on one PC in ten minutes will catch every class mistake while it is still your problem, not fifty people's problem.
Honest note: a storage-class block does not stop a determined person with a phone camera or cloud upload - and it is not meant to. It stops bulk copying to pocket storage, which is the everyday risk. Keep keyboards and printers out of the blast radius so the control survives contact with real office work.
Watch the Complete Video Guide
The full Device Control Plus walkthrough - policy creation, trusted devices and reports, shown live step by step.
Will blocking USB storage stop my USB printer from working?
No. Printers belong to a different device class than removable storage. A policy built on the storage class in Device Control Plus leaves printers, scanners, keyboards and mice fully working.
Can some staff get read-only access instead of a full block?
Yes. File access control lets you set read-only permission for a user or group - they can open files from a drive but cannot copy office data onto it. Full block and full allow are not the only two choices.
What about the CD or DVD drive - is that covered too?
Optical drives are their own device type and can be restricted separately, for example set to read only. In most modern offices they are rare, but if your PCs have them, include them in the same policy decision.
This guide is based on the Technical Anshu video on controlling USB devices in the office - stuck on any step, ask in the video comments.