BitLocker USB control stops USB printers — GPO for device classes
Joe B.
Reviewed for technical accuracy
Specialities: Windows printing, BitLocker USB control, Group Policy (GPO), device installation restrictions, print servers & USB printers
BitLocker USB control blocks USB printers — GPO device setup classes, USB storage vs printer class GUIDs, layered evaluation
Technician
Quick scan so I can see how Group Policy is affecting things:
• Which Windows version are the users on (Windows 10/11 Pro, Enterprise, mixed)?
• Are these domain-joined devices using GPO, Intune, or just local security policy?
• What do you see when you plug in a USB printer — “Device installation forbidden by system policy”, “Deny write access to removable drives not protected by BitLocker”, or plain “access denied” when installing the print driver?
• Roughly which policies did you enable: BitLocker Removable Data Drives, Device Installation Restrictions, or a vendor “USB device control” baseline?
Technician
In many environments the security baseline:
• Enables Deny write access to removable drives not protected by BitLocker for USB storage.
• Adds Device Installation Restrictions rules like “Prevent installation of devices that match any of these device setup classes” to block USB mass storage or even all new USB devices.
If the GPO is too broad (for example it includes the USB class GUID or even the printer device setup class), Windows treats your USB printers as blocked hardware. We’ll keep USB storage locked but create an allow rule for printer device classes so your users can still plug in and use USB printers.
Plan:
1) Confirm whether the block is coming from BitLocker removable drive policy or from Device Installation Restrictions.
2) Add an “Allow installation of devices using drivers that match these device setup classes” rule for printers (GUID_DEVCLASS_PRINTER and PNPPrinters).
3) Enable Apply layered order of evaluation for Allow and Prevent device installation policies so the allow printer rule wins over generic USB blocks.
4) Refresh GPO, unplug/re-plug the printer, and if needed reinstall the print driver package.
Technician
On an affected PC:
1) Run
gpresult /h c:\gp.html as admin → open the report → under Computer Configuration → Administrative Templates look for:• System → Device Installation → Device Installation Restrictions
• Windows Components → BitLocker Drive Encryption → Removable Data Drives.
2) In Event Viewer go to Applications and Services Logs → Microsoft → Windows → DeviceSetupManager. Plug the printer in and look for events mentioning “device installation is restricted by policy” along with a device setup class GUID or hardware ID.
3) If the message talks about write access to removable drives and drive letters, it’s a BitLocker USB write-access issue. If it specifically cites device installation or device setup classes, the block is from Device Installation Restrictions.
From what you described (unknown device + “installation forbidden by system policy”), we’re almost certainly dealing with the Device Installation Restrictions GPO. Next we’ll carve out an exception for printer device classes so USB printers are allowed while your BitLocker USB control remains strict for storage.
Technician
On a domain controller with Group Policy Management:
1) Edit the GPO that’s enforcing USB control (same one with the Prevent rules).
2) Go to:
Computer Configuration → Policies → Administrative Templates → System → Device Installation → Device Installation Restrictions.
3) Enable “Allow installation of devices using drivers that match these device setup classes” and add the printer-related class GUIDs, for example:
•
{4d36e979-e325-11ce-bfc1-08002be10318} — GUID_DEVCLASS_PRINTER (Printers)•
{4658ee7e-f050-11d1-b6bd-00c04fa372a7} — GUID_DEVCLASS_PNPPRINTERS (PnP printers)4) Keep your existing Prevent installation of devices that match any of these device IDs or device classes for USB storage (e.g., USBSTOR) so flash drives remain blocked.
This way GPO still enforces USB lockdown, but the printer device class is explicitly allowed so Windows can install USB printers and their drivers.
Technician
Step 3 — Make sure Allow printer classes override the Prevent rules
In the same Device Installation Restrictions node:
1) Enable “Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria”.
• This tells Windows to consider Allow rules for device instance IDs, hardware IDs, and device setup classes before the broad Prevent rules.
2) Keep “Prevent installation of devices not described by other policy settings” enabled — it’s what blocks unknown USB gadgets — but now devices that match your printer device class allow list will be exempt.
3) Optionally enable “Allow administrators to override Device Installation Restriction policies” so IT can still plug in service tools or capture device IDs when needed.
After you set Apply layered order of evaluation, your Allow printer class rule gets a chance to win even though you’re still preventing “everything else” including untrusted USB storage.
Technician
• BitLocker USB control settings like “Deny write access to removable drives not protected by BitLocker” affect volumes (USB drives) once they’re mounted. They don’t normally stop a USB printer driver from installing, because printers don’t expose a writable volume in the same way a flash drive does.
• Your current issue is the device driver never installing — that’s almost always the Device Installation Restrictions (setup classes / hardware IDs) we’re adjusting now.
You can safely keep BitLocker USB enforcement in place for removable data drives while we:
1) Allow the printer device setup classes via GPO.
2) Keep storage-related classes and USBSTOR hardware IDs blocked.
Result: USB storage stays locked behind BitLocker, but USB printers enumerate and install normally on the endpoints.
Technician
On a test workstation in the affected OU:
1) Run
gpupdate /force or reboot so the new Allow printer device class rule and layered evaluation setting apply.2) Open Device Manager → View → Show hidden devices → under Printers and Universal Serial Bus controllers remove any Unknown device entries related to previous failed attempts (right-click → Uninstall device, check “Delete the driver software” if available).
3) Unplug the USB printer, wait 10 seconds, plug it back in. You should now see Windows installing the printer driver instead of “device installation blocked by policy”.
4) If you want to be extra strict, grab the printer’s device instance ID from Device Manager and add it to “Allow installation of devices that match any of these device instance IDs”. That lets you whitelist specific printer models while still keeping other random printer hardware blocked.
Technician
• The Class GUID approach (
{4d36e979-...} and {4658ee7e-...}) covers a broad set of USB and network printers from HP, Brother, Canon, etc.• You continue to block USB storage using USBSTOR device IDs and storage-related setup classes, so BitLocker USB control still protects data exfiltration.
When to add specific hardware / instance IDs:
• When you only want to allow a very small set of printer models and block everything else, including other printers that users might bring from home.
• When you’re troubleshooting a stubborn printer that’s still mis-classified and you want to temporarily whitelist that exact device instance ID to confirm the root cause.
For now I’d start with just the device setup class allow list; if you later decide you need tighter control, we can layer in specific device IDs for your HP/Brother fleet.
Technician
Summary: If BitLocker USB control or device installation GPO stops your USB printers, don’t rip out security. Instead:
• Keep your BitLocker removable drive policies and USB storage blocks in place.
• In Device Installation Restrictions, enable Allow installation of devices using drivers that match these device setup classes and add the printer class GUIDs.
• Turn on Apply layered order of evaluation so those allow rules override the global prevent rules.
• Refresh GPO and reinstall the USB printer.
Need help finding the exact device IDs, class GUIDs, or testing on a small OU before rolling it out? Open the chat and a Windows GPO specialist will walk you through the changes safely.
Quick answer: the accepted fix
Accepted fix when BitLocker USB control stops USB printers: keep your BitLocker removable drive policies, but in Device Installation Restrictions add an Allow installation of devices using drivers that match these device setup classes rule for printer class GUIDs, enable Apply layered order of evaluation, refresh GPO, and reinstall the USB printer so drivers can install while USB storage stays blocked.
Why BitLocker USB control and GPO can block USB printers
In many security baselines, admins combine BitLocker USB control (e.g., “Deny write access to removable drives not protected by BitLocker”) with Device Installation Restrictions that block new USB hardware using device setup classes, hardware IDs, or device instance IDs. If the GPO treats everything on the USB bus as “untrusted”, Windows may prevent USB printer driver installation and show “device installation forbidden by system policy”. By contrast, network printers and existing print queues keep working because they don’t rely on new USB devices being installed.
How to verify a GPO device class is blocking USB printers
To confirm a GPO device class rule is blocking your USB printer, review DeviceSetupManager events when the printer is plugged in and note any device setup class GUID or USBSTOR hardware ID mentioned. Compare that with your GPO under System → Device Installation → Device Installation Restrictions — if you see the same GUID listed under “Prevent installation of devices using drivers that match any of these device setup classes” and no matching Allow rule, then the printer is being caught by your USB control policy. Adding an Allow printer device class rule and enabling layered evaluation lets you maintain BitLocker USB security while freeing up USB printers to install.
BitLocker USB control & printers — quick troubleshooting tips
Most “USB printer blocked by BitLocker / device control” cases come from broad Device Installation Restriction rules.
Quick path: identify whether the block is from BitLocker removable drive settings or from Device Installation Restrictions; then, in GPO, add an Allow installation of devices using drivers that match these device setup classes rule for printer class GUIDs, enable Apply layered order of evaluation, and leave USB mass storage blocked. Finally, refresh policy and reinstall the USB printer to confirm it now bypasses the device control while your BitLocker USB protection remains intact.
Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making changes to security policies.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.
Expert will respond in minutes
We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.
Save time & money
No scheduling hassles or expensive consults. Membership can save you significant time and money each month.
FAQ
Why did BitLocker USB control suddenly break USB printers?
Usually it’s not BitLocker alone, but a combination of BitLocker removable drive policies and Device Installation Restrictions. A broad GPO that blocks new USB devices can accidentally include printer device setup classes, so the OS refuses to install USB printers while still allowing existing network print queues.
How can I allow USB printers but still block USB storage with BitLocker?
Keep your BitLocker removable data drive policies and USBSTOR blocks, but in Device Installation Restrictions enable “Allow installation of devices using drivers that match these device setup classes” and add the printer class GUIDs. Turn on layered evaluation so those Allow printer rules override the generic Prevent rules.
What device setup class GUID should I allow for printers?
Typically you allow GUID_DEVCLASS_PRINTER ({4d36e979-e325-11ce-bfc1-08002be10318}) and GUID_DEVCLASS_PNPPRINTERS ({4658ee7e-f050-11d1-b6bd-00c04fa372a7}) in the “Allow installation of devices using drivers that match these device setup classes” GPO. That lets Windows install printer drivers while other USB classes remain controlled.
USB printer is still blocked after updating GPO. What should I check?
First run gpupdate /force or reboot and confirm the new Allow printer class rule is present in gpresult. Then remove the failed device from Device Manager, check DeviceSetupManager logs for any remaining blocked class GUIDs, and verify that Apply layered order of evaluation is enabled so the allow rule can override prevent rules.
Sources
- Microsoft — Manage device installation with Group Policy (allow/deny rules, device IDs, setup classes)
- Microsoft — Overview of device setup classes (GUID_DEVCLASS_PRINTER and others)
- Call4Cloud — Allow users to install printer drivers using device setup class GUIDs
Filed under: Printer won’t print
Related articles
- Printer says “Offline” and won’t print — what should I check first?
- My printer “forgot” my Wi-Fi — the saved network is gone
- Printer Wi-Fi settings reset by itself — why did it forget my network?
- My printer keeps popping up “Set up Wi-Fi” again — why won’t it stay connected?
- Why does my printer need Wi-Fi setup again? It was working yesterday.
- My printer Wi-Fi setup keeps failing — what am I doing wrong?
- Printer Wi-Fi setup is confusing — why won’t it connect to my network?
- Printer Wi-Fi setup is too complicated — what do I check first without messing it up?