In this, you will learn everything about the USB Management feature found in the Client Management section of the Heimdal Dashboard.
1. USB Management view
2. USB Management settings
USB Management allows you to control the way the USB ports work inside your company. They can be restricted or allowed, depending on your preferences
USB MANAGEMENT view
The USB Management page displays all the information related to the USB devices that are plugged in after enabling the USB Management service. At the top, you see a statistic regarding the number of USB Detections.
The collected information is placed in the Standard view.
-
Standard
This view displays a table with the following details: Hostname, Username, Device name (Friendly name), Device ID (Device instance path), Hardware ID, Class ID (Class Guid), Action, and Timestamp. Selecting an entry will allow you to add the detected USB device to the Allowlist or to hide it from this view (by taking the Suppress action) and move it to the Show suppressed devices page. Adding a device to the Allowlist can be done based on the following criteria: Hardware ID, Class ID (Class Guid), or Device instance path. -
Show suppressed devices
This view displays a table that includes the hidden USB devices and the following details: Hostname, Username, Device name (Friendly name), Device ID (Device instance path), Hardware ID, Class ID (Class Guid), Action, and Timestamp. The devices that are disconnected and plugged in again will switch back to the Standard view.
The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard mode corresponding to each view. The Filters functionality allows you to filter entries by Resolution.
Note: Partial matching is not supported for Hardware ID, Device Instance Path, or Device Name searches. The search function requires an exact match to return results.
USB MANAGEMENT
Enabling USB Management will enable USB Management on the endpoints applying the Group Policy.
USB Management - turns the USB Management module ON or OFF.
General Settings
USB reporting mode - retrieves the USB devices connected to the target endpoints without applying any settings. All detected USB devices will be listed on the USB Management page. This option is not available while Disable USB storage/media devices is enabled.
Disable USB storage/media devices - blocks USB storage and removable media devices (controlled by the USB mass storage driver, the Generic USB interface driver, and Removable Storage Devices such as USB drives, CD/DVD, or SD cards) from being used on the computer. Keep in mind that storage devices controlled by other services might still be allowed. A computer reboot is required to activate/deactivate this function.
USB restrictive mode - blocks ALL USB devices connected to the endpoint, except those explicitly added to the Allowlist (based on Hardware ID, Class GUID, or Device instance path). This option can only be enabled when Disable USB storage/media devices is enabled. A system reboot is required to apply or remove this setting. In rare cases, enabling this functionality may prevent external or dockable peripheral devices (such as keyboards and mice) from connecting.
Allowlist
The Allowlist section becomes available when both Disable USB storage/media devices and USB restrictive mode are enabled. It allows you to allowlist a USB device based on Hardware ID, Class GUID, or Device instance path. You can give a Friendly name to each entry (up to 250 characters), and you can also import an Allowlist from a CSV file using the Import button (a sample CSV file is available from the tooltip next to the section title) or export the current Allowlist using the Download Allowlist .csv button. Existing entries can be searched and are listed in a grid with the Friendly name, Value, Type, and Action columns.
Note: The Allowlist feature is not supported on Windows Home edition.
The Friendly name field can be used to improve visibility and management of the USB devices by assigning custom, descriptive names to USB devices. This allows administrators to provide a meaningful, custom label for each USB device, improving identification across environments with multiple similar USB entries, while managing both visible and suppressed USB devices more efficiently. This capability aims to simplify USB tracking and reduce confusion when multiple devices share similar identifiers.
Predefined Class GUIDs provide a curated list of commonly used USB device classes, each displayed with the USB class name and a short descriptive label. When selecting a predefined class:
- The Friendly name field is automatically populated with the selected USB class name.
- The Value field is automatically populated with the corresponding Class GUID.
After selecting, both fields remain fully editable, allowing administrators to customize entries as needed.
Any allowlisted USB entry can be removed at any time by deselecting it or by using the Remove option from the Allowlist grid.
IMPORTANT
USB devices are nested under each other in the PnP tree. See below how the enumeration of a USB drive looks in the Device Manager compared to the Heimdal Dashboard.
The Hardware ID is different based on the brand/model of the USB device. The top one is the most specifically identified, as shown below:
The Class GUID (Class Guid in Windows) is shared by all USB devices of the same type, and this is how it can be found:
It's not enough to allow only a single Hardware ID to enable a single USB thumb drive. The IT admin has to ensure that all the USB devices preceding the target one are allowed as well (all enumerations).
Example 1: the following entries have to be allowed so that the plugged-in USB thumb drive can be allowed (to see this view, access View -> Devices by connection in Device Manager):
- Intel(R) USB 3.0 eXtensible Host Controller - 1.0 (Microsoft) -> PCI\CC_0C03
- USB Root Hub (USB 3.0) -> USB\ROOT_HUB30
- Generic USB Hub -> USB\USB20_HUB
- USB Mass Storage Device
-
Generic Flash Disk USB Device
Note: In some cases, a USB device may appear connected and accessible even if the partition entry shown in Device Manager isn't explicitly allowlisted. This is because the partition will be registered under a different parent node in the device tree, allowing initial USB recognition to succeed without full allowlisting. However, as noted in the image above, it's still strongly recommended to allowlist the partition entry as well (meaning all the enumerations). Certain Group Policy settings can block access to volumes that aren't explicitly allowed, which may cause file access to silently fail, even if the device seems properly connected. These devices are internal devices on the machine that define the USB port connection to the outside world. Enabling them shouldn't prevent any external/peripheral device from being installed on the machine. Specifically for desktop machines, it's very important to list all the USB devices that your keyboards and mice are connected to in the above list. Failing to do so could block a user from accessing their machine through HID devices.
The behavior of all USB devices can vary depending on the USB vendor, firmware, and controller design. As such, we can't always guarantee identical behavior across all devices. Some sticks enumerate differently or present partitions in ways that require the partition to be allowlisted for full functionality.