Cannot access USB drive

JaredBusch

I have a customer that was testing out settings via InTune for compliance with some BoA requirements.

The tests proved their point in managing restrictions, etc.

But now, I wanted to change everything back and something is not working.

We had set Removable Storage to Block. It work. I now set it back to not configured and the test user still cannot use removable storage.

This was the only setting made and only this profile was configured.

When you insert a USB drive now, it is detected and this pops up.

I popped into gpedit.msc and all settings are set to "Not Configured" so nothing should be causing this by policy.

I'm assuming there is some registry setting that is fucked up, but I have no idea.

This is a Windows 10, non-domain computer originally. It was joined to AzureAD specifically for InTune testing. This was the only policy created in InTune and only this one setting.

1337

Check the registry according to this:
https://www.isumsoft.com/windows-10/how-to-disable-use-of-usb-storage-devices-in-windows-10.html

JaredBusch

@Pete-S said in Cannot access USB drive:

Check the registry according to this:
https://www.isumsoft.com/windows-10/how-to-disable-use-of-usb-storage-devices-in-windows-10.html

Thanks.
Of course, the user shut off his computer and left for the day....

I have it ready to push through ScreenConnect to check as soon as it come online tomorrow..

#!ps
#maxlength=50000
#timeout=300000
Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR -Name Start

Dashrender

I don't think setting it to unconfigured undoes the original change. you have to change the setting to not blocked, or unblocked, whatever the option is, then give that time to actually apply, then you can set it back to unconfigured.

JaredBusch

@Dashrender said in Cannot access USB drive:

I don't think setting it to unconfigured undoes the original change. you have to change the setting to not blocked, or unblocked, whatever the option is, then give that time to actually apply, then you can set it back to unconfigured.

Not how InTune policy works.

FFS, the screenshot looks pretty straightforward

Dashrender

@JaredBusch said in Cannot access USB drive:

@Dashrender said in Cannot access USB drive:

I don't think setting it to unconfigured undoes the original change. you have to change the setting to not blocked, or unblocked, whatever the option is, then give that time to actually apply, then you can set it back to unconfigured.

Not how InTune policy works.

FFS, the screenshot looks pretty straightforward

I hear yeah... Then perhaps the setting hasn't been pushed down to the client yet.

JaredBusch

@Dashrender said in Cannot access USB drive:

@JaredBusch said in Cannot access USB drive:

@Dashrender said in Cannot access USB drive:

I don't think setting it to unconfigured undoes the original change. you have to change the setting to not blocked, or unblocked, whatever the option is, then give that time to actually apply, then you can set it back to unconfigured.

Not how InTune policy works.

FFS, the screenshot looks pretty straightforward

I hear yeah... Then perhaps the setting hasn't been pushed down to the client yet.

It has, because prior to turning it back off, the drives were not detected at all.

Dashrender

@JaredBusch said in Cannot access USB drive:

@Dashrender said in Cannot access USB drive:

@JaredBusch said in Cannot access USB drive:

@Dashrender said in Cannot access USB drive:

I don't think setting it to unconfigured undoes the original change. you have to change the setting to not blocked, or unblocked, whatever the option is, then give that time to actually apply, then you can set it back to unconfigured.

Not how InTune policy works.

FFS, the screenshot looks pretty straightforward

I hear yeah... Then perhaps the setting hasn't been pushed down to the client yet.

It has, because prior to turning it back off, the drives were not detected at all.

oh wow - the rule kills the ability to even detect them.. weird.

JaredBusch

@Pete-S said in Cannot access USB drive:

Check the registry according to this:
https://www.isumsoft.com/windows-10/how-to-disable-use-of-usb-storage-devices-in-windows-10.html

Well, that's not it.

Obsolesce

Is Windows up to date?

Have you tried another USB drive?

Have you checked in Disk Management?

JaredBusch

@Obsolesce said in Cannot access USB drive:

Is Windows up to date?

Yes

Have you tried another USB drive?

Multiple

Have you checked in Disk Management?

As soon as you format it in DM, it pops up the error.

Obsolesce

@JaredBusch said in Cannot access USB drive:

@Obsolesce said in Cannot access USB drive:

Is Windows up to date?

Yes

Have you tried another USB drive?

Multiple

Have you checked in Disk Management?

As soon as you format it in DM, it pops up the error.

I think that's a Windows thing. I've always had trouble on Win10 lately (not Intune related) with USB drives. Easily fixed by formatting in on Mac or Linux in my experience.

black3dynamite

@Obsolesce said in Cannot access USB drive:

@JaredBusch said in Cannot access USB drive:

@Obsolesce said in Cannot access USB drive:

Is Windows up to date?

Yes

Have you tried another USB drive?

Multiple

Have you checked in Disk Management?

As soon as you format it in DM, it pops up the error.

I think that's a Windows thing. I've always had trouble on Win10 lately (not Intune related) with USB drives. Easily fixed by formatting in on Mac or Linux in my experience.

So it doesn't work with diskpart too?

JaredBusch

@black3dynamite said in Cannot access USB drive:

@Obsolesce said in Cannot access USB drive:

@JaredBusch said in Cannot access USB drive:

@Obsolesce said in Cannot access USB drive:

Is Windows up to date?

Yes

Have you tried another USB drive?

Multiple

Have you checked in Disk Management?

As soon as you format it in DM, it pops up the error.

I think that's a Windows thing. I've always had trouble on Win10 lately (not Intune related) with USB drives. Easily fixed by formatting in on Mac or Linux in my experience.

So it doesn't work with diskpart too?

Diskpart does everything it is supposed to do.

once the format completes, windows tells you to fuck off.

1337

@JaredBusch said in Cannot access USB drive:

@Pete-S said in Cannot access USB drive:

Check the registry according to this:
https://www.isumsoft.com/windows-10/how-to-disable-use-of-usb-storage-devices-in-windows-10.html

Well, that's not it.

That sucks...

What does the device manager in Windows say? Maybe there is some USB host controller/hub driver that has become corrupted.

zachary715

See if this registry key is present and what it is set to...

HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\System
Name: AllowStorageCard
Type: DWORD
Value: 0 for block, 1 for allow

JaredBusch

@zachary715 said in Cannot access USB drive:

See if this registry key is present and what it is set to...

HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\System
Name: AllowStorageCard
Type: DWORD
Value: 0 for block, 1 for allow

I'm all out of ideas..

Dashrender

Time to take a snap of the registry, then apply the change, then compare them.

JaredBusch

@Dashrender said in Cannot access USB drive:

Time to take a snap of the registry, then apply the change, then compare them.

It is already broke. that will not find a change.

Dashrender

@JaredBusch said in Cannot access USB drive:

@Dashrender said in Cannot access USB drive:

Time to take a snap of the registry, then apply the change, then compare them.

It is already broke. that will not find a change.

my bad - I meant get a new machine/image, snap before applied.. then apply snap again and compare.