Manage USB ports on Surface devices

With USB port functionality enabled by default on Surface devices, many devices with Surface UEFI allow admins to turn off connectivity to USB ports. For example, you may wish to prevent users from copying data from USB thumb drives or external hard disks.

Prerequisites

Before you begin the process outlined in this article, familiarize yourself with the following technologies and tools:

• Surface IT Toolkit is available to download from Surface Tools for IT.
• Surface UEFI
• Surface Enterprise Management Mode (SEMM)
• PowerShell scripting
• Deploy applications with Configuration Manager

Get started

The process consists of the following parts:

1. Enrollment: Enroll Surface devices and docks into SEMM using the Surface UEFI Configurator, as outlined in Secure Surface Dock ports with SEMM. Supported docks include Surface Dock 2 and Surface Thunderbolt 4 Dock. Key to this workflow is the ability to turn off USB-C data, Ethernet data, and USB-C audio whenever devices are disconnected from an authorized Surface Dock located, for example, in a workplace environment handling highly sensitive information.

2. Client configuration: Install UEFI Manager, available from the Surface IT Toolkit Library, on all Surface devices targeted for management.

3. PowerShell scripts: Go to the Surface IT Toolkit to download and modify the PowerShell scripts as appropriate for your environment. Use Microsoft Configuration Manager to deploy the scripts (as applications) to target devices, following the instructions in Use Microsoft Configuration Manager to manage devices with SEMM.

Refer to the embedded comments for usage guidance. See Appendix: SEMM PowerShell Scripts tech reference for definitions and prerequisites.

Manage USB-A ports

For USB-A ports supporting USB-2 and USB-3, you can turn off the USB data protocol from the USB controller to prevent all functionality.

Granular USB-C Disablement

Managing USB-C ports with their support for DisplayPort and USB Power Delivery provides more options beyond turning off all functionality. For example, you can prevent data connectivity to stop users from copying data from USB storage but retain the ability to extend displays and charge the device via a USB-C dock.

Beginning with Surface Pro 8, Surface Laptop Studio, and Surface Go 3, granular USB-C management options are available via the SEMM PowerShell scripts.

1. Go to Surface Tools for IT and download SEMM_PowerShell.zip.

2. If you don't already have your own certificates, you can obtain certificates via the appropriate sample script, as documented in the Appendix on this page.

Dynamic USB-C Disablement

Dynamic USB-C Disablement enables customers operating in highly secure environments to prevent unauthorized data transfer via USB, thereby offering organizations more control. When paired with the Surface Thunderbolt 4 Dock, IT admins can lock down USB-C ports whenever eligible Surface devices are undocked or connected to an unauthorized dock.

In this scenario, when users are connected to an authorized dock in the office, the USB-C ports will have full functionality over their devices. However, when they go off-site, they can still connect to a dock to use accessories or a monitor but can't use the USB ports to transfer data.

Dynamic USB-C Disablement provides IT admins with greater flexibility to manage devices with a new "Mode 3" in addition to existing operational modes:

• Mode 0 (Default Mode): The default mode when SEMM isn't configured.

• Mode 1 (Data Disabled): USB-C and Ethernet data are disabled. Audio via USB-C is also disabled. Display out and Power functionality is enabled.

• Mode 2 (Fully Disabled): USB-C and Ethernet data are disabled. Audio via USB-C is also disabled. Display out and Power functionality is disabled.

• Mode 3 (USB Port Authenticated) also known as Dynamic USB-C Disablement. USB-C data, Ethernet data, USB-C audio, display out and power functions only when the device is connected to an authorized Surface Thunderbolt 4 Dock. If connected to an unauthorized dock, only display out and Power functions will work.

Manage USB-C ports with Surface IT Toolkit

You can now manage USB-C ports across all modes via either of the following methods:

• The new UEFI Configurator included in the Surface IT Toolkit provides UI-support to configure ports without use of PowerShell scripts.
• PowerShell scripts, as described in this article.

Target behaviors

Provisioning Surface docks

1. Use the appropriate provisioning script, as documented in the Appendix on this page.

   • ConfigureSEMM - Dock2.ps1
   • ConfigureSEMM - Thunderbolt(TM)4Dock-Provisioning

2. Open ConfigureSEMM.ps1 and modify as appropriate. For example, to disable USB-C ports, enable the following setting: UsbPortHwDisabled. See the following table for all available options.

Table 1. USB port management options for Surface devices

Department vs. organizational provisioning

Dynamic USB-C Disablement allows for a many-to-many relationship between the host and dock. This lets customers have hosts and docks configured to work with all hosts/docks or make it department-specific to help with asset management.

Table 2. Example relationships: Host device with Surface Thunderbolt 4 Dock

Appendix: SEMM PowerShell Scripts tech reference

Learn more

• Configure Surface devices with PowerShell
• Configure Surface Docks