Decide who can use a USB drive, and on which computers

Block USB drives for standard users and keep them working for admins. It’s one click.

On Windows, RFF writes the same Removable Storage Access policy you’d set in Group Policy, into each signed-in user’s registry, and Windows enforces it. Stop the RFF agent and the drive stays blocked.

You can also make drives read-only, approve the encrypted sticks you hand out, and let someone who gets blocked ask for access from the message on their screen. Macs and Linux get most of it too (what runs where).

It’s on every plan, Free included, and it stays off until you turn it on in Settings > Device Control.

See it in the live demo → · the demo fleet has Device Control on, with the usual starting rule

See every USB device first

Turn it on and every agent reports what’s plugged in, and everything that gets plugged in after that: the device type, vendor and product IDs, serial number, the computer and the signed-in user, when it was first and last seen, and how many times it was plugged in. Nothing is blocked yet. That history is what every rule is previewed against later.

Filter the last 7, 30 or 90 days by type, or search a name, a serial or a VID:PID. Every computer’s page has a USB tab with the same list for that machine. Give a device a name, tags and a description, for one unit or a whole model, and the label follows it everywhere it appears, including the rule dialog. Known hardware-encrypted models (Apricorn Secure Key 3.0, iStorage, IronKey, Kanguru Secure Pen) carry a “hardware-encrypted” label from a maintained ID list.

Rules

A rule is which devices, what happens, who it applies to, and where.

• Devices - USB drives, phones, CD/DVD, ISO images and virtual DVD drives, cameras, Bluetooth, printers, or one specific device by vendor and product ID, down to its serial number if you want
• Action - allow, read-only (drives) or block
• Who - everyone, standard users only (admins keep the device), the members of an Active Directory or Entra group, or one person
• Which computers - all of them or an RFF group, and optionally only on, or only off, the company network
• What the user sees - the rule’s own message with a Request access button, the message alone, or nothing at all

The usual starting rule is one click: Block USB storage for standard users. Rules run in the order you set, and each computer’s USB tab answers “which rules apply here, and why” for every device type, for standard users and for admins.

Bluetooth has its own rule: block Bluetooth file transfer and keep headsets, mice and keyboards working.

Exceptions that end on time

• Approved drives - approve one drive by its serial number, with an optional end date. Pair approvals with a block for everyone and only the approved drives work, or with read-only for everyone and only the approved drives can be written to. Each computer drops an approval at its end date by its own clock, even offline
• Access requests - a blocked user clicks Request access on the notice. You see who, which device and which computer, and approve it for an hour up to a week, or deny it. Approved, that person can use the device on any of their computers until the time runs out, and each computer ends it on time, even offline

Every rule change, approval and denial is in the audit log with who did it.

Before a rule reaches anyone

• Preview - before you save, RFF runs the rule against the real device events from your fleet and lists the computers, users and devices it would have stopped. A rule that would have blocked a dock on forty machines shows up here, before it fires
• Canary first - a change can go to a few online computers first (about 10% of the rule’s computers, 1 to 10 of them) or to a canary group you pick, and to everyone else an hour later. If a canary stops checking in after the change, the rollout halts and emails you. Resume, release or roll back from the rule
• Drives already plugged in - a change reaches them too: the agent restarts the drives the change affects so the new rule applies at once. When a drive can’t be restarted, its computer says “applies after a replug” instead of claiming the rule took

How a block holds

Windows 10 and 11. RFF writes Windows’ own device policies: Removable Storage Access in each signed-in user’s part of the registry for the per-user rules, and Device Installation Restrictions for machine-wide device blocks. Windows enforces both, so a block keeps working with the RFF agent stopped.

Linux. A polkit rule stops standard users mounting removable drives, and a udev rule switches off blocked USB devices, cameras, Bluetooth and printers. The system reads both files itself, so they also hold with the agent stopped.

Mac. The agent refuses the mount before it happens, or mounts the drive read-only itself, so an unapproved drive is never mounted writable. That needs the agent running: with it stopped, macOS mounts drives normally. For a block that holds without the agent, use your MDM’s restriction profile. RFF isn’t an MDM.

Two things RFF won’t do, whatever a rule says:

• Touch a network adapter. A USB NIC or a dock’s Ethernet is never blocked, so a rule can’t cut a computer off from the console
• Fight another policy. Where Group Policy or an MDM already sets removable storage, RFF leaves it alone and that computer says why

AD and Entra groups

Active Directory. Windows puts the user’s AD groups in their sign-in, and the agent reads them there. AD group rules work on domain-joined and hybrid-joined computers with no directory connector.

Microsoft Entra ID. Windows only includes an Entra group in the sign-in when the computer itself references that group, so a rule built on the sign-in alone would miss members. Connect your Entra directory once from Device Control > Settings: RFF gets read-only access to group memberships, nothing else, and reads every Entra group rule’s members every 10 minutes. Add someone to the group in Entra and their computers have it within minutes, without signing out. An MSP connects each client’s directory from that client’s account.

Splunk

Device events and access requests can go to Splunk’s HTTP Event Collector. Send now posts a test event straight away, so you can check the URL and token before you rely on it.

File activity (Windows)

Turn on File activity in Device Control’s settings and Windows computers record every file written to or deleted from a USB drive: when, which computer, who, the file, the drive and the program that did it. The list shows the newest 500 from the last 30 days and searches by file, computer, user or program, and the events go to Splunk too.

RFF turns on Windows’ own Audit Removable Storage to do it and puts it back when you turn this off. Opening or reading a file isn’t recorded. Windows starts watching a drive when it’s plugged in, so a drive that was already plugged in is recorded after a replug. It’s off until an admin turns it on.

What runs where

Where a rule asks for something a computer can’t do, that computer’s row says so instead of reading as applied.

What it doesn’t do

• No file rules. Device Control decides which devices work, not which files go onto them. File-type rules and content inspection need a kernel driver, and RFF doesn’t install one
• File activity is a record, not a gate. It lists what was written to or deleted from a USB drive on Windows; it doesn’t stop a copy, and it doesn’t record files read or copied off a drive. Macs and Linux don’t have it

What it costs

Nothing extra. Device Control is on every plan, Free included, so the first 100 endpoints cost nothing. Pricing has the rest.

Try the live demo → · no signup   Start free - 100 endpoints →