Server Usb - Windows

| Device Type | Default Behavior (Standard User) | Default Behavior (Administrator) | | :--- | :--- | :--- | | (Flash drives, HDDs) | Blocked (Read/Write disabled) | Allowed (Mounted automatically) | | USB HID (Keyboard, Mouse) | Allowed (Required for local mgmt) | Allowed | | USB Printers / Scanners | Blocked (Requires policy change) | Allowed | | USB Network Adapters | Blocked (Security risk) | Allowed with driver install |

auditpol /set /subcategory:"Removable Storage" /success:enable /failure:enable | Event ID | Source | Description | | :--- | :--- | :--- | | 2003 | Microsoft-Windows-USB-USBHUB3 | Device connected (Win10/Server 2019+) | | 225 | Kernel-PnP | Device installed (legacy) | | 4663 | Security | Attempted access to removable storage object |

Boot into Directory Services Restore Mode (DSRM) and modify USBSTOR registry key manually from recovery command prompt.

| Device Type | Default Behavior (Standard User) | Default Behavior (Administrator) | | :--- | :--- | :--- | | (Flash drives, HDDs) | Blocked (Read/Write disabled) | Allowed (Mounted automatically) | | USB HID (Keyboard, Mouse) | Allowed (Required for local mgmt) | Allowed | | USB Printers / Scanners | Blocked (Requires policy change) | Allowed | | USB Network Adapters | Blocked (Security risk) | Allowed with driver install |

auditpol /set /subcategory:"Removable Storage" /success:enable /failure:enable | Event ID | Source | Description | | :--- | :--- | :--- | | 2003 | Microsoft-Windows-USB-USBHUB3 | Device connected (Win10/Server 2019+) | | 225 | Kernel-PnP | Device installed (legacy) | | 4663 | Security | Attempted access to removable storage object |

Boot into Directory Services Restore Mode (DSRM) and modify USBSTOR registry key manually from recovery command prompt.