Configure whitelisting for ClickShare Button via Local Group Policy Object (GPO) Windows Only

Article number: [2336] - Legacy code: [KB11117]

This article applies to the following products:

In some companies, the IT policy built into laptops prevents the use of the ClickShare Button (i.e. USB port blocked). The button is not recognized by the operating system.

The process to remove the USB block so that the Clickshare Button is recognized is unique to your company and will need to be customized, this is a general guideline.

It is stressed this is not a verbatim process, each company may have its unique process - the local group policy can be over-ridden by Active Directory Policy.

For a more detailed approach see:

https://docs.microsoft.com/en-us/windows/security/threat-protection/device-control/control-usb-devices-using-intune

Step-1:- Find the Button Hardware values needed to whitelist

a) Plug the Clickshare Button into a Laptop which with no USB Port Blocks.

b) Press Window + R Key to open the RUN command and type devmgmt.msc

 c) Get Clickshare Hardware Id Values from any of the highlighted locations shown in the image below.

Optionally the ID can be obtained with this PowerShell script (copy/paste):

param($computerName = "localhost")

Get-WmiObject Win32_USBControllerDevice -ComputerName $ComputerName `

-Impersonation Impersonate -Authentication PacketPrivacy |

Foreach-Object { [Wmi]$_.Dependent } | ? name -Match 'button'

d) The Clickshare Button hardware value can be extracted.

Step-2:- Block All USB Ports via GPO

Initially, you should block all USB devices not certified by the IT department

a) Right-click on desktop > click on New > click on Shortcut

b) Type gpedit.msc > press Next >Create the name of Shortcut as gpedit and click Finish.

c) Right-click the shortcut and select Run as Administrator.

d) Click on Administrative Templates > click on System > click on Device Installation > open Device installation Restrictions > click on Prevent Installation of devices not described by other policy settings

A new dialogue box opens.

 e) Select Enabled, apply the Settings, and click OK

f) Now the policy must be activated. Press the Window + R key to open the RUN command and type gpupdate /force /boot/logoff

 

Step-3:- Finally we can Whitelist the Clickshare Button with GPO

Open Group Policy as before with Administrative rights (step 2b)

a) Click on Administrative Templates > click on System > click on Device Installation > open Device installation Restrictions > click on Allow installation of devices that match any of these device IDs

A new dialogue box opens.

 

b) Add Clickshare white values we discovered in step 1d

 

c) Example: Button whitelist values (get yours from step 1d)

  • USB\VID_0600&PID_009F
  • USB\VID_0600&PID_009F&MI_04
  • USB\VID_0600&PID_009F&MI_00
  • USB\VID_0600&PID_009F&MI_03
  • USB\VID_0600&PID_009F&MI_01
  • USB\VID_0600&PID_009F&MI_02
  • Barco_ClickShare_0
  • MMDEVAPI\AudioEndpoints
  • USB\VID_0600&PID_009F&MI_04
  • USB\VID_0600&PID_009F&REV_0210&MI_04

d) Finally reload the group policy: Press Window + R Key to open the RUN command and type gpupdate /force /boot/logoff
 

SUMMARY:

The only USB device that will be recognized by the Windows OS is now the Clickshare Button, no other USB device will be recognized. 

Addendum:

The following information of the Button needs to be whitelisted (this is a label on the Button):

  • Buttons with article number R9861006D01 have VID_0600 and PID_0070
  • Buttons with article number R9861500D01 have VID_0600 and PID_009f 
  • Buttons with article number R9861600D01 have VID_0600 and PID_00CE

Properties

Last updated Jun 14 2022

Was this information helpful?