Prevent installation of devices using drivers that match these device setup classes
This computer policy prevents Windows from installing or updating driver packages whose device setup class GUID appears in the deny list.
since 0.9.8.11
Purpose
Show registry keys (3)
HKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClassesHKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClassesRetroactiveHKLM\Software\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceClasses\<Wertname>
This computer policy prevents Windows from installing or updating driver packages whose device setup class GUID appears in the deny list. A device setup class groups devices that Windows installs and configures in a similar manner. The restriction can therefore cover an entire class of devices rather than one model or individual device instance.
The DenyDeviceClasses value under the Restrictions key enables the restriction. String values under the separate DenyDeviceClasses subkey hold the denied device setup class GUIDs. The names of these list entries provide their numbering; the GUID stored as each entry's data determines the class being denied.
Without retroactive enforcement, the policy blocks new installations and driver updates but generally leaves devices that are already installed unaffected. DenyDeviceClassesRetroactive extends the restriction to matching devices that are already installed.
Notes
Additional effects
On a Remote Desktop Session Host, the policy also affects redirection of matching devices from a Remote Desktop client to the host.
By default, device installation policies that deny installation take precedence over policies that allow it. If layered evaluation is enabled separately, overlapping rules are evaluated by specificity: device instance ID, device ID, device setup class, and then removable-device status. A more specific allow rule can consequently override a broader class-based denial for the applicable device.
Security
The policy can stop devices in unapproved setup classes from being newly installed or updated with another driver package. This can reduce exposure to unwanted peripheral devices and attacks that depend on installing them.
It is not a general access-control mechanism for the functions or data of a device. In particular, a non-retroactive class restriction does not automatically revoke access to a device that is already installed, and it does not replace policies that control read or write access to removable storage.
Possible side effects
Device setup classes can have broad scope. Retroactive enforcement can therefore make devices required for normal operation unavailable. Microsoft identifies internal disk drives and network devices as critical examples. Depending on the denied class, the computer can lose boot capability, network connectivity, or local input.
Multifunction and composite devices often contain several Plug and Play nodes with different class GUIDs. A class restriction might consequently disable only part of a device, or a denied parent node might affect several child functions.
Notes
The policy has device scope and affects every user of the computer. Device setup classes are represented by GUIDs enclosed in braces. Because one physical device can correspond to multiple nodes in the Plug and Play device tree, the complete set of affected class GUIDs determines which device functions are actually blocked.
Microsoft documentation
Microsoft Learn: Manage device installation with Group Policy