disable usb so how to exclude few users


  • I have enforced a GPO policy e.g. disable usb so how to exclude few users? Need to create security group add exclude users select deny it will work? Or need to go with block inheritance

    Saturday, July 4, 2015 4:37 AM


  • Hi aburmila,

    You don't have to create 2 GPOs to meet your requirement. You can create just one GPO and go to user configuration>>Administrative Templates>>System Removable Storage access>> All removable storage classess: deny all access>> enabled.

    Link the gpo to the related user account OU and then you can use the scurity filtering or delegation tab to filter out the specific users. A user must have the read and apply permission on the gpo then he might able to apply this gpo setting. Otherwise, he would not able to apply the gpo.

    You can check below article for more references to know about the security filtering and gpo delegation:

    Best Regards,


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact

    Tuesday, July 7, 2015 7:29 AM

All replies