Restrict Driver Installation Using Windows Registry

This guide explains how to prevent the installation of unauthorized or non-standard hardware drivers on Windows using the Registry Editor (Regedit). By configuring device installation restriction policies within the registry, system administrators can enforce strict hardware compliance, block unapproved peripheral devices, and ensure that only pre-authorized or standard drivers are deployed across workstations.

Step 1: Open the Registry Editor

  1. Press Win + R to open the Run dialog box.
  2. Type regedit and press Enter.
  3. Select Yes when prompted by User Account Control (UAC).

Step 2: Navigate to the Device Installation Policy Key

Navigate to the following path in the Registry Editor address bar:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows

Check if the DeviceInstall key exists under Windows: * If it exists, expand it and look for the Restrictions key. * If either key is missing, right-click on the parent key, select New > Key, and name them sequentially to create:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions

Step 3: Configure Device Restriction Values

Select the Restrictions key to configure policy values that control driver installations:

1. Block Unapproved/Unspecified Drivers

To block all hardware drivers that are not explicitly permitted by an approved list: 1. Right-click inside the right pane of Restrictions. 2. Select New > DWORD (32-bit) Value. 3. Name the value DenyUnspecified. 4. Double-click DenyUnspecified and set its Value data to 1. 5. Click OK.

2. Apply Restrictions to Administrators (Optional)

By default, these restrictions may not apply to local administrators. To enforce restrictions on administrators as well: 1. Create a new DWORD (32-bit) Value named DenyDeviceClassesRetroactive or DenyUnspecified. 2. Create another DWORD (32-bit) Value named DenyAdminInstall. 3. Double-click DenyAdminInstall and set its Value data to 1. 4. Click OK.

Step 4: Whitelist Approved Standard Hardware (Optional)

If DenyUnspecified is set to 1, you must specify standard hardware classes to allow necessary hardware (such as approved keyboards, mice, or system devices) to install:

  1. Under Restrictions, right-click and create a new key named AllowDeviceClasses.
  2. Inside AllowDeviceClasses, create String Values (REG_SZ) numbered sequentially (1, 2, 3, etc.).
  3. Set the Value data of each string to the approved Device Class GUID (for example, {4d36e96b-e325-11ce-bfc1-08002be10318} for standard keyboards).

Step 5: Apply and Verify the Policy

  1. Close the Registry Editor.
  2. Restart the computer, or open the Command Prompt as Administrator and run gpupdate /force to immediately apply policy changes.
  3. To verify, attempt to connect a non-standard device. Windows will display an error indicating that installation has been blocked by system policy.