Mid ka mid ah caqabadaha ugu waaweyn ee maamulaha IT-ga ee shirkadda waa inuu xannibo gelitaanka aaladaha sida USB , Hard Drive-ka Dibadda^{(External Hard Drive)} , iyo xitaa daabacayaasha aaladaha ururka. Si tan loo fududeeyo, Microsoft waxa ay soo saartay qaab-dhismeedka Siyaasadda Kooxda Layered ee^{(Layered Group Policy feature)} siinaya maamulayaasha awoodda ay ku kala qaybiyaan qalabka lagu rakibi karo mishiinnada ururka oo dhan.

Waa maxay siyaasadda kooxda^{(Group Policy)} lakabka ah ee Windows 11 ?

Siyaasadda^{(Group Policy)} Kooxdan waxay ujeedadeedu tahay in la hubiyo in mishiinadu helaan musuqmaasuq yar, tirada kiisaska taageerada hoos u dhacdo, iyo tan ugu muhiimsan waa in la yareeyo xatooyada xogta. Siyaasaddu waxay hubisaa in la xaddido rakibid kasta, ie, isticmaalka aaladaha gudaha iyo dibaddaba waa la xannibay. Maamulka IT-ga ayaa dooran kara aaladaha horay loo oggolaaday in la isticmaalo/la rakibo.

Halkan laga heli karo^(Available) , qoraalku wuxuu hubinayaa inaan dhammaan fasallada la xannibin:

Computer Configuration > System > Device Installation > Device Installation Restrictions

Tani waxay la macno tahay in haddii aad dooratay inaad xannibto isticmaalka aaladda USB , waxay xannibaysaa oo keliya. Horay u socoshada hal talaabo, qaabka cusubi waxa uu xalinayaa dhibaatadii hore halkaas oo loo baahan yahay in la sameeyo dhawr qaybood si looga fogaado isku dhac. Taa baddalkeeda, waxaad haysataa Instance ID > Device ID > Class > Removable hantida qalabka la rari karo.

Sida loo dabaqo siyaasadda kooxda lakabka ah^{(Layered Group Policy)} ee Windows 11

Siyaasadda ugu horreysa ee aad u baahan tahay si aad karti u siiso waa — Codso nidaamka qiimaynta ee Oggolaan iyo Ka Hortagga xeerarka rakibaadda qalabka dhammaan shuruudaha u dhigma qalabka^{(Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria)} .

Marka la sameeyo, waxaa jira siyaasado dheeri ah, waxaadna u baahan tahay inaad hubiso inaad maskaxda ku hayso nidaamka kala sareynta ( Aaladaha^(Device) tusaale ahaan IDs > Device IDs > Device dejinta Qalabka> Aaladaha la > Removable ) Waa kuwan siyaasadaha la xiriira mid kasta:

Aqoonsiga tusaalaha aaladda

• Kahortagga^(Prevent) rakibidda aaladaha addoo isticmaalaya darawallada ku habboon aaladdan aqoonsiga tusaale ahaan^(IDs)
• Oggolow^(Allow) rakibaadda aaladaha addoo isticmaalaya darawallada ku habboon aaladdan aqoonsiga^(IDs) tusaale ahaan .

Aqoonsiga aaladda

• Kahortagga^(Prevent) rakibidda aaladaha iyadoo la adeegsanayo darawallada ku habboon aqoonsiga aaladdan
• Oggolow^(Allow) rakibaadda aaladaha addoo isticmaalaya darawallada ku habboon aqoonsiga qalabkan

fasalka dejinta qalabka

• Kahortagga^(Prevent) rakibidda aaladaha iyadoo la adeegsanayo darawallada u dhigma fasallada dejinta qalabkan
• Oggolow^(Allow) rakibida aaladaha adoo isticmaalaya darawalada u dhigma fasalada dejinta qalabkan.

Qalabka la saari karo

• Kahortagga^(Prevent) rakibidda aaladaha la saari karo

Habbee^(Configure) mid kasta oo iyaga ka mid ah adiga oo ku dara aqoonsiga aaladda ama aqoonsiga fasalka oo mari isbeddellada.

Microsoft waxay ku talinaysaa in loo isticmaalo siyaasaddan " Kahortagga rakibaadda aaladaha aan lagu sifayn dejinta siyaasadaha kale^{(Prevent installation of devices not described by other policy settings)} " dejinta siyaasadda sababta oo ah qaabka lakabaysan.

Sida loo helo aqoonsiga Hardware^{(Hardware ID)} ama aqoonsiga ku habboon

• Fur Maareeyaha Aaladda^{(Device Manager)} adigoo isticmaalaya Win + X , oo ay ku xigto adigoo riixaya M.
• Hel qalabka Midig ku dhufo, ka dibna dooro Properties
• U beddel tabka Faahfaahinta
• Guji^(Click) hoos u dhaca hantida^(Property) , oo halkan waxaad ka dooran kartaa aqoonsiga hardware, aqoonsiga fasalka, iyo faahfaahin kale. Qiimaha saxda ah ayaa laga heli doonaa qaybta qiimaha.

Sida loogu daro Aaladaha Aqoonsiga^{(Device IDs)} liiska Oggolow^(Allow) ?

• Fur nidaamka- Oggolow rakibida aaladaha ku habboon mid ka mid ah aqoonsiga qalabkan^{(Allow installation of devices that match any of these device IDs)} .
• Dooro karti^{(Select Enabled)} , ka dibna dhagsii badhanka Show ee hoos yimaada Options.
• Ku dar aqoonsiga^{(Add Compatible ID)} ku habboon ama Aqoonsiga Hardware^{(Hardware ID)} liiska
• Codso isbedelada

Waxa kale oo aad xannibi kartaa rakibaadda qalabyada gaarka ah adiga oo isticmaalaya siyaasadaha rakibidda ka hortagga^(Prevent) .

Sidee loogu oggolaadaa maamulayaasha inay ka gudbaan xannibaadaha rakibidda qalabka?

Waxa jirta siyaasad u gaar ah tan oo aad awood u yeelan karto. Marka la furo, xubnaha kooxda maamulayaasha^{(Administrators)} waxay isticmaali karaan ku dar saaxirka Hardware^{(Add Hardware)} ama wizard darawalka cusbooneysiinta si ay u rakibaan oo u cusbooneysiiyaan qalabka.

Sidee loo dejiyaa wakhti go'an si loo dhaqan geliyo isbeddelka siyaasadda?

Haddii aad rabto inaad dhaqangeliso isbeddelka siyaasadda, waxaad u baahan tahay inaad dib u bilowdo. Goobtu waxay kuu ogolaanaysaa inaad dejiso Wakhtiga Dib-u- bootka^(Timeout) ee loo soo bandhigay isticmaal-yahanka ugu dambeeya si loo hubiyo inaysan jirin wax khasaare ah oo xog ah.

Waxaan rajeynayaa in boostada si cad kuugu sharraxday Siyaasadda Kooxda Lakabka ah ee^{(Layered Group Policy)} gudaha Windows 11 .

Siyaasadda^{(The policy)} sidoo kale waa laga heli karaa gudaha Windows 10  iyada oo qayb ka ah Juulay 2021^{(July 2021)} ikhtiyaarka ikhtiyaarka ah "C" siideynta macmiilka waxaana la samayn doonaa si ballaadhan oo la heli karo laga bilaabo Agoosto 2021 ^{(August 2021)} Cusbooneysii Talaadada^{(Update Tuesday)} siideynta.

How to apply Layered Group Policy in Windows 11/10

One of the biggest сhallenges for an IΤ admin in a company is tо block access to devices such as USB, External Hard Drive, and even Printers to the organization’s devices. To make this a little eаsier, Microsoft has rolled out the Layered Group Policy feature that gives administrators the ability to divide which devices can be installed on machines across the organization.

What is Layered Group Policy in Windows 11?

This Group Policy aims to ensure the machines get less corruption, the number of support cases drops, and the most important is to reduce data theft. The policy ensures to restrict any installation, i.e., the use of devices both in the internal and external environment is blocked. IT admins can choose to pre-authorized devices to be used/installed.

Available here, the script makes sure not all classes are blocked:

Computer Configuration > System > Device Installation > Device Installation Restrictions

this means that if you chose to block the USB device usage, it only blocks it. Going one step ahead, the new feature resolves the earlier problem where several sets need to be created to avoid conflict. Instead, you have hierarchical layering Instance ID > Device ID > Class > Removable device property.

How to apply Layered Group Policy in Windows 11

The first policy you need to enable is — Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.

Once done, there are an additional set of policies, and you need to ensure to keep the hierarchical order (Device instance IDs > Device IDs > Device setup class > Removable devices) in mind. Here are the policies related to each:

Device instance IDs

• Prevent installation of devices using drivers that match these device instance IDs
• Allow installation of devices using drivers that match these device instance IDs.

Device IDs

• Prevent installation of devices using drivers that match these device IDs
• Allow installation of devices using drivers that match these device IDs

Device setup class

• Prevent installation of devices using drivers that match these device setup classes
• Allow installation of devices using drivers that match these device setup classes.

Removable devices

• Prevent installation of removable devices

Configure each of them by adding the device id or class ID and apply the changes.

Microsoft recommends using this policy over the “Prevent installation of devices not described by other policy settings” policy setting because of the layered structure.

How to find the Hardware ID or Compatible ID?

• Open Device Manager using Win + X, followed by pressing M.
• Locate the device. Right-click on it, and then select Properties
• Switch to the Details tab
• Click on the Property dropdown, and here you can select hardware ID, class ID, and other details. The exact value will be available in the value section.

How to add Device IDs to the Allow list?

• Open the policy— Allow installation of devices that match any of these device IDs.
• Select Enabled, and then click on the Show button under Options.
• Add Compatible ID or Hardware ID to the list
• Apply the changes.

You can also block the installation of specific devices by using the Prevent installation policies.

How to allow administrators to override device installation restrictions?

There is a policy specific to this which you can enable. Once enabled, members of the Administrators group can use the Add Hardware wizard or the update driver wizard to install and update the device.

How to set up a timeout to enforce policy change?

If you want to enforce the policy change, you need to reboot. A setting allows you to set up a Reboot Timeout displayed to the end-user to make sure there is no data loss.

I hope the post explained to you clearly about the Layered Group Policy in Windows 11.

The policy is also available in Windows 10  as part of the July 2021 optional “C” client release and will be made more broadly available beginning in the August 2021 Update Tuesday release.

Related posts

• Sida loogu daro Tifaftiraha Siyaasadda Kooxda Windows 11/10 Daabacaadda Guriga

• Sida loo sahlo ama loo joojiyo Win32 Wadooyinka Dheer ee Windows 11/10

• Tirtir profile-kii hore iyo faylalka si toos ah gudaha Windows 11/10

• Sida loo joojiyo Picture Password-ka xulashada gudaha Windows 11/10

• Sida loola socdo dhaqdhaqaaqa isticmaalaha ee Habka Kooxda Shaqada ee Windows 11/10

• Sida Looga Hortago Isticmaalayaasha inay tirtiraan Xogta ogaanshaha gudaha Windows 11/10

• Sida loo Xakameeyo Kharashka Batteryga ilaa boqolkiiba qaar ka mid ah Windows 11/10

• Sida loo joojiyo bilawga degdega ah ee Windows 11/10 (iyo sababta aad u baahan tahay)

• Soo rar, Dhoofinta, Dayactir, Soo Celinta Nidaamka Dab-damiska ee caadiga ah gudaha Windows 11/10

• Jooji Windows 10 ka hor raritaanka Microsoft Edge ee Bilawga

• Sida loo dabaqo Siyaasadda Kooxda Maamulayaasha Aan Maamulayn kaliya Windows 10

• Sida loo hubiyo caafimaadka Hard Drive-ka gudaha Windows 11/10

• Beddel Kaydinta Hagaajinta Gaadhsiinta ee Cusbooneysiinta Daaqadaha

• Ka ilaali isticmaalayaasha inay beddelaan taariikhda iyo wakhtiga Windows 11/10

• Dejinta Siyaasadda Kooxda ayaa ka maqan Windows 11/10

• Xaddid Dejinta Bandwidth Reservable ee gudaha Windows 11/10

• Sida loo hubiyo Nidaamka Kooxda ee lagu dabaqay kumbuyuutarka Windows 10

• Daar, Dami Si toos ah oo u iftiimi ereyada khaldan ee Windows

• Sida loogu qasbo Cusboonaysiinta Siyaasadda Kooxda gudaha Windows 11/10

• Sida loo xalliyo Arrimaha Maqalka Guud ee Windows 11/10