Preventing Installation of Specific Devices

Applies To: Windows Server 2008

Windows Vista and Windows Server 2008 enable an administrator to prevent installation of specific hardware devices on managed computers. This control is provided by a set of Group Policy settings that can be applied individually on a computer or, by using Active Directory™ Domain Services, to all computers that are part of a domain, site, or organizational unit.

Administrators, by default, are also affected by these policies unless you configure Windows to exempt them from these restrictions. For more information, see Allow Administrators to Override Device Installation Restriction Policies.


These policy settings take precedence over any other policy settings that allow a device to be installed. If any of these policy settings prevent a device from being installed, the device cannot be installed or updated, even if the device matches another policy setting that otherwise allows installation of that device.

Task requirements

The following is required to perform the procedures for this task:

  • Group Policy Management Editor, which is included with Windows Vista and Windows Server 2008, and can be used to edit the settings on individual computers.

  • Group Policy Management Console, which is included with Windows Server 2008, and can be used to configure the settings in Group Policy objects (GPOs) that can be applied to many computers in an Active Directory domain.

To complete this task, you can perform the following procedures: