Block Device Class Installation via Regedit

This article explains how to prevent users and the system from installing specific hardware device classes, such as webcams or imaging devices, using the Windows Registry Editor (regedit). By configuring device restriction registry keys and targeting unique Device Setup Class Globally Unique Identifiers (GUIDs), administrators can enforce strict hardware installation policies across Windows workstations.

Step 1: Find the Device Setup Class GUID

Every hardware category in Windows has a specific Class GUID. To block a device class, you must first identify its identifier.

• Cameras: {ca3e7ab9-b4c3-4ae6-8251-579ef933890f}
• Imaging Devices (older webcams and scanners): {6bdd1fc6-810f-11d0-bec7-08002be2092f}
• USB Devices: {36fc9e60-c465-11cf-8056-444553540000}

To locate a custom GUID for any other device: 1. Open Device Manager (devmgmt.msc). 2. Right-click the target device and select Properties. 3. Go to the Details tab. 4. In the Property dropdown, select Class Guid. 5. Copy the value including the curly braces.

Step 2: Configure Registry Policies

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.

2. Navigate to the following path:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

3. Check if the DeviceInstall key exists under Windows. If not:

   • Right-click Windows > New > Key.
   • Name it DeviceInstall.

4. Right-click DeviceInstall > New > Key and name it Restrictions.

5. Inside the Restrictions key:

   • Right-click on the right pane > New > DWORD (32-bit) Value.
   • Name it DenyDeviceClasses.
   • Double-click it and set its Value data to 1.
   • (Optional) To also apply this restriction to devices that are already installed, create another DWORD (32-bit) Value named DenyDeviceClassesRetroactive and set its Value data to 1.

Step 3: Add the Target Class GUID to the Blocklist

1. Under the Restrictions key, create a new subkey:
   • Right-click Restrictions > New > Key.
   • Name it DenyDeviceClasses.
2. Select the newly created DenyDeviceClasses key.
3. In the right pane, create string values for each class you want to block:
   • Right-click > New > String Value.
   • Name the string 1 (for additional classes, increment the names to 2, 3, etc.).
   • Double-click 1 and set its Value data to the GUID of the device class (e.g., {ca3e7ab9-b4c3-4ae6-8251-579ef933890f}).

Step 4: Apply the Changes

1. Close the Registry Editor.

2. Open Command Prompt as Administrator and run the following command to refresh local policies:

   gpupdate /force

3. Restart the computer for all settings to take full effect.

Once configured, any attempt to install drivers or connect new devices belonging to the specified class GUID will be blocked by Windows.