Trusted Device List in Device Control Plus Add Only Office Drives
Block everything unknown, but register the office's own drives once so real work never stops. Run the trusted list like an asset register - sticker, holder, permission, quarterly review.
Technical AnshuManageEngine Device Control PlusFor IT admins and office owners
Watch the full video - Device Control Plus setup shown step by step on screen
Every office has legitimate pen drive work: the auditor's assistant carrying Tally backups, the site engineer taking drawings to a client, the admin moving a large installer to a PC with no network share. A block-everything policy makes enemies of exactly these people. The answer in ManageEngine Device Control Plus is the Trusted Devices list - the office's own drives, registered once by their device identity, work everywhere; every other drive in the world stays blocked. This page is about running that list like an asset register, not a favour list.
Trusted Devices List (Example Entries)
Office drive 01 - Accounts backupRead and writeTRUSTED
Office drive 02 - Accounts backupRead and writeTRUSTED
Office drive 03 - Site engineerRead and writeTRUSTED
Office drive 04 - Installer kitRead only sourceLIMITED
Any other USB storageBlockedDENY
A short list is a control. A long list is just allowing everything, slowly.
Example trusted list. Names are illustrative - use your own asset names and keep the list this short.
1
Buy the Drives Yourself and Register Them Once
Buy a small stock of identical drives from the office budget - the cost is trivial next to one data leak.
Plug each drive into a managed PC and add it to the Trusted Devices list in the Device Control Plus console. The tool identifies the specific device, so a look-alike drive of the same model is not automatically trusted.
Put a physical sticker on each drive with the same name you used in the console - "Office drive 03 - Site engineer". When a drive is lost, you know exactly which list entry to remove.
Record who holds each drive, the same way you record laptop chargers or office keys.
2
Give Trusted Drives the Right Permissions
Trusted does not have to mean unlimited. Set the permission to match the job:
Backup drives for accounts: read and write, but only on the accounts PCs - a trusted drive does not need to work on the reception PC.
Installer kit drives: write access for IT, read for everyone else, so the kit spreads tools but does not collect data.
Where the product offers it, prefer encrypted devices for drives that will leave the building - Device Control Plus can require that only encrypted devices connect, or enforce encryption on write. A lost encrypted drive is an embarrassment; a lost plain drive is a data breach.
3
Review and Shrink the List Regularly
Trusted lists grow by kindness and shrink by nobody. Fix that with a calendar:
Once a quarter, open the trusted list and the device usage report side by side. Any drive not plugged in for 90 days comes off the list until someone asks again.
Remove a drive the day it is reported lost - that is the whole point of registering devices individually.
When a staff member leaves, collect their drive the same day you collect their keys, and confirm the handover in your register.
The audit report is your friend here: it shows managed devices, users and computers together, so a trusted drive that suddenly appears on a new PC at odd hours stands out.
Honest check: if your trusted list needs fifty drives, your real problem is the workflow, not the list. A shared folder, a file server or an approved cloud drive usually replaces most pen drive work - move the work there and keep the trusted list for the few jobs that genuinely need physical media.
Watch the Complete Video Guide
The full Device Control Plus walkthrough - policy creation, trusted devices and reports, shown live step by step.
A staff member lost a trusted pen drive. What should I do?
Remove that device from the Trusted Devices list in the console immediately - it then becomes just another blocked drive on every managed PC. If the drive held office data and was not encrypted, treat the loss as a data incident and inform management the same day.
Can two identical pen drives of the same model be told apart?
Yes. Trusted device registration works on the individual device identity, not just the model name, so registering your office drive does not silently trust every identical-looking drive bought from a shop.
How many trusted drives should a small office have?
As few as the work allows - often between two and ten for a small office. One per genuine use case: backups, field work, installer kit. If the list keeps growing, move that workflow to a shared folder instead.
This guide is based on the Technical Anshu video on controlling USB devices in the office - stuck on any step, ask in the video comments.