# Removable storage and device control policies are enforced via Intune
Microsoft Defender for Endpoint device control restricts the use of removable storage including USB mass storage, MTP devices, optical media, Bluetooth…
Source: https://maester.dev/docs/tests/ZTA.41051
## Overview
Microsoft Defender for Endpoint device control restricts the use of removable storage including USB mass storage, MTP devices, optical media, Bluetooth peripherals, and printers by enforcing read, write, and execute access policies at the device class level. When device control is not enforced, an adversary with physical access or a malicious insider can deliver payloads via USB, exfiltrate sensitive data to removable media, or stage execution from auto-running content without any policy intervening. The risk is not limited to targeted attacks: commodity malware has long used removable media as a propagation mechanism, and without enforcement the organization has no preventive control at the boundary between the managed endpoint and the physical world.
## Remediation
- [Microsoft Defender for Endpoint device control overview](https://learn.microsoft.com/en-us/defender-endpoint/device-control-overview)
- [Deploy and manage device control with Intune](https://learn.microsoft.com/en-us/defender-endpoint/device-control-deploy-manage-intune)
- [Device control policies](https://learn.microsoft.com/en-us/defender-endpoint/device-control-policies)
- [Device control reports](https://learn.microsoft.com/en-us/defender-endpoint/device-control-report)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| ATT&CK | [T1052.001](/docs/tests?mitre=T1052.001) Exfiltration over USB, [T1091](/docs/tests?mitre=T1091) Replication Through Removable Media, [T1200](/docs/tests?mitre=T1200) Hardware Additions |
| Licence | INTUNE_A&WINDEFATP |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.