Device Control

The Device Control module allows you to control the use of USB devices (USB keys, hard drives, etc.). Device Control lets you create a USB device Policy: you define general rules that allow or block USB devices based on their class.

What is possible:

• Configuration by device type

• Implemented using CrowdStrike Policies, either by you or by the Stoïk SOC

• Configuration of exclusions (workstation, device)

• Can be managed with the Device Control Manager user right

What is not possible:

• Configuration by endpoint (this would require assigning each endpoint to specific groups)

For example, you can create a policy to block USB storage devices while allowing access to other USB device classes.

Deployment

Stoïk team

Define your control objectives

Determine what you want to enforce:

• Block all USB devices

• Set devices to read-only

• Allow only specific models

• Monitor / audit usage without blocking (observation mode)

Inventory of authorized or blocked devices

For each USB device you want to allow or block:

1. Plug it into a workstation.

2. Retrieve its hardware identifiers.

Via the graphical interface:

Device Manager > USB device > right-click > Properties > Details > Hardware IDs

Via PowerShell:

Get-PnpDevice -PresentOnly | Where-Object { $_.Class -eq "USB" }

1. Send the following information to [e-mail]:

   • Vendor ID (VID)

   • Product ID (PID)

   • Serial number (if applicable)

Stoïk team configuration

A Stoïk cybersecurity engineer configures the rules and informs you once the setup is complete.

Self-service

Request Device Control Manager access to your CrowdStrike console by emailing [e-mail].

Create and configure the policy

1. Go to Endpoint Security > USB Device Control > Policies.

2. Click Create policy, enter a name and optional description, then click Create policy to confirm.

3. In the Settings tab:

   • Select the mode (Monitor, Monitor and enforce, or Off for macOS only).

   • Enable the desired USB settings.

   • Select the notification to inform end users when a USB device is fully blocked.

   • Select the notification to inform end users when a USB device is restricted.

4. In the USB Device tab, expand each device class to include, choose the authorization level, and add exceptions per class if needed by clicking Add exception.

The three modes work as follows:

• Monitor and enforce: Actively applies defined rules, blocks or allows USB connections and logs activity.

• Monitor only: Logs connections without enforcing restrictions. Ideal for testing policies without disrupting users.

• Off (macOS only): Completely disables Device Control; no activity is logged or blocked.

Using Monitor only is an effective way to establish a list of USB devices typically used by your employees, which can then serve as the basis for a future allowlist.

Activate the policy

1. Click Save in the top-right corner, then Save again to confirm.

2. In the Assigned host groups tab, click Assign host groups to policy.

3. Click Enable policy.

To speed up configuration of similar policies, click Duplicate policy to create an exact copy.

Policy deployment

Windows

Device policies are applied as soon as a USB device is connected to a host. If USB devices are already connected at the time the policy is assigned, they will only be affected upon their next reconnection or the next host reboot.

macOS

Device policies are applied as soon as a USB or Bluetooth device is connected to a host. If devices are already connected at the time the policy is assigned, the policy takes effect immediately. If the policy blocks the device, it will be disconnected.