Skip to content

Commit e85a08e

Browse files
Merge pull request #2536 from sblee84/docs-editor/device-control-walkthroughs-1737731962
Update device-control-walkthroughs.md
2 parents f368fa1 + 94f9fc3 commit e85a08e

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

defender-endpoint/device-control-walkthroughs.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Learn how to work with device control in Defender for Endpoint.
44
author: denisebmsft
55
ms.author: deniseb
66
manager: deniseb
7-
ms.date: 02/14/2024
7+
ms.date: 01/24/2025
88
ms.topic: overview
99
ms.service: defender-endpoint
1010
ms.subservice: asr
@@ -36,7 +36,7 @@ By default, [device control](device-control-overview.md) is disabled and there a
3636

3737
Device control in Defender for Endpoint identifies a device based on its properties. Device properties are visible by selecting an entry in the report.
3838

39-
The **Device ID**, **Vendor ID** (VID), **Serial number**, and **Bus type** can all be used to identify a device (see [Device control policies in Microsoft Defender for Endpoint](device-control-policies.mddata is also available in [advanced hunting](/defender-xdr/advanced-hunting-overview), by searching for the `Plug and Play Device Connected action` (`PnPDeviceConnected`), as shown in the following example query:
39+
The **Device ID**, **Vendor ID** (VID), **Serial number**, and **Bus type** can all be used to identify a device (see [Device control policies in Microsoft Defender for Endpoint](device-control-policies.md)). Data is also available in [Advanced Hunting](/defender-xdr/advanced-hunting-overview), by searching for the Plug and Play Device Connected action (`PnPDeviceConnected`), as shown in the following example query:
4040

4141
```kusto
4242
@@ -62,7 +62,7 @@ DeviceControlState : Disabled
6262
6363
```
6464

65-
Change the device control state to be enabled* on a test device. Make sure the policy is applied by checking [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus), as illustrated in the following snippet:
65+
Change the device control state to be enabled on a test device. Make sure the policy is applied by checking [Get-MpComputerStatus](/powershell/module/defender/get-mpcomputerstatus), as illustrated in the following snippet:
6666

6767
```powershell
6868
@@ -184,7 +184,7 @@ The following screenshot shows the settings we used for our example:
184184

185185
By default, the sample uses the Global SID of `S-1-1-0`. Before deploying the policy, you can change the SID associated with the authorized USBs (writeable USBs) to `User1` and change the SID associated with the Read Only USBs to `User2`.
186186

187-
Once the policy is deployed, only User 1 has write access to the Authorized USBs, and only User 2 has read access to the ReadOnly USBs.
187+
Once the policy is deployed, only User 1 has write access to the Authorized USBs, and only User 2 has read access to the ReadOnly USBs.
188188

189189
Device control also supports group SIDs. Change the SID in the read-only policy to a group that contains `User2`. Once the policy is redeployed, the rules are the same for User 2 or any other user in that group.
190190

0 commit comments

Comments
 (0)