Since the release of cumulative updates after April 2025, IT administrators have been facing significant challenges with USB device control functionality under Windows 10 and 11. The feature designed to restrict access to removable storage devices through Group Policy (GPO) has reportedly malfunctioned, leaving organizations vulnerable to potential security threats such as malware infections via USB drives. Initially identified by a concerned reader, Marcel, this issue has since been confirmed by Microsoft and is currently under investigation.
The core problem lies in how Windows handles driver validation after the transition of its pre-production driver signing infrastructure due to expiring certificate authorities (CAs). This change affects Group Policy enforcement mechanisms that rely on driver-level control. As a result, settings previously used to block USB removable storage devices are no longer functioning as intended post-update.
Microsoft is actively working towards resolving this issue and anticipates implementing the necessary fixes in future cumulative updates. In the interim period, organizations can attempt mitigating measures such as recreating Group Policy settings or submitting detailed feedback through Microsoft’s Feedback Hub for accelerated resolution.
Third-party information around the topic: USB Device Control Best Practices Before and After Updates
Recent updates have highlighted significant vulnerabilities when relying solely on built-in Windows tools like Group Policy Objects (GPO) to manage access controls. As organizations scramble to find workarounds, there is a growing need for robust third-party solutions that offer granular control over device usage. These alternatives can be seamlessly integrated with existing security frameworks and provide additional layers of protection against unauthorized data leakage or malware propagation via removable media.
Moreover, industry experts recommend adopting a multi-layered approach to USB management which includes leveraging advanced endpoint security software capable of real-time monitoring and blocking suspicious activities associated with USB devices. This proactive stance not only bolsters immediate defenses but also prepares IT teams for future updates that may introduce similar challenges.
Third-party info short title: Enhancing Security Beyond Built-in GPO
Similar questions
What are cumulative updates?
When did the USB device control issue start?
How does Group Policy work with Windows updates?
Why is Microsoft changing its driver signing infrastructure?
Can malware still infect computers through USB drives now?
What is a certificate authority (CA) in this context?
How do I recreate Group Policy settings?
Is there any specific feedback that can help resolve the issue faster?
Are there any temporary solutions available until Microsoft fixes it?
How often are cumulative updates released for Windows 10 and 11?