Microsoft today introduced a new feature for IT professionals, the Layered Group Policy. The new feature allows you to configure devices that can be installed on machines in your organization and which are prohibited.
Windows 10 users already have multi-level Group Policy with optional “C” updates in July 2021. They will be released to everyone with the August 2021 Patch Tuesday.
The new option is located in Computer Configuration> Administrative Templates> System> Device Installation> Device Installation Restrictions.
Existing device restriction policies work with the IDs of each device that the operating system can recognize (such as class, device ID, and instance ID).
The license list, written by the system administrator, contains sets of IDs representing different devices. In this way a system understands which device is allowed and which is blocked.
By adding the new Multilevel Policy Group to existing device installation policies, Microsoft makes this process much easier.
Intuitive use: With the new policy, you do not need to know the different device categories to prevent the installation of USB classes only. The new policy allows you to focus on scripts of actions of USB classes and be sure that all other classes will be excluded unless the administrator allows it.
Flexibility: In the past, every prevention policy took precedence over any licensing policy, which created a set of definitions and a rigid set of devices to allow or prevent devices. This caused update strains every time a new set of devices entered the settings.
With the new policy, hierarchical layers are used in the following order:
The classification of the ID of each device works as a priority value.
If all USB classes are restricted by Group Policy, one or more USB devices in the permissions list may be ranked higher. However, the list of allowed devices can only be counted when a device from the list of allowed devices is connected to the computer.
George is still wondering what he is doing here….
