3,381 settings · 22H2 · 1.0 · 15 Jul 2024

1 settingCSV

Allow RDP redirection of other supported RemoteFX USB devices from this computer ComputerIntune-ready

Back to the list

Windows Components › Remote Desktop Services › Remote Desktop Connection Client › RemoteFX USB Device Redirection

Allow RDP redirection of other supported RemoteFX USB devices from this computer

ComputerNative Intune settingTS_USB_REDIRECTION_DISABLE

Supported on At least Windows 7 with Service Pack 1 or Windows Server 2008 R2 with Service Pack 1

22H2 · 1.0

What it does

This policy setting allows you to permit RDP redirection of other supported RemoteFX USB devices from this computer. Redirected RemoteFX USB devices will not be available for local usage on this computer. If you enable this policy setting, you can choose to give the ability to redirect other supported RemoteFX USB devices over RDP to all users or only to users who are in the Administrators group on the computer. If you disable or do not configure this policy setting, other supported RemoteFX USB devices are not available for RDP redirection by using any user account. For this change to take effect, you must restart Windows.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client

In Intune

Native Intune setting: Yes — Policy CSP

./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLEADMX_TerminalServer on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
RemoteFX USB Redirection Access RightsRequiredDefault: Adminstrators and Users	Drop-down list	`fUsbRedirectionEnableMode`	Adminstrators Only`1` Adminstrators and Users`2`

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client]
"fUsbRedirectionEnableMode"=dword:00000002

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Allow RDP redirection of other supported RemoteFX USB devices from this computer
# Name: TS_USB_REDIRECTION_DISABLE
# Scope: Machine
# State: Enabled
# Source: TerminalServer.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client' -Name 'fUsbRedirectionEnableMode' -PropertyType 'DWord' -Value 2

These deployment candidates come from the ADMX template; they are separate from the native CSP mapping above.

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE

ADMX SyncML candidate

<SyncML xmlns="SYNCML:SYNCML1.2">
  <SyncBody>
    <Replace>
      <CmdID>1</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE</LocURI>
        </Target>
        <Data>&lt;enabled/&gt;
&lt;data id="UsbAccessRight" value="1"/&gt;</Data>
      </Item>
    </Replace>
    <Final/>
  </SyncBody>
</SyncML>

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Allow RDP redirection of other supported RemoteFX USB devices from this computer
# Name: TS_USB_REDIRECTION_DISABLE
# Scope: Machine
# State: Enabled
# Source: TerminalServer.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client' -Name 'fUsbRedirectionEnableMode' -Kind 'DWord' -Expected 2
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client\fUsbRedirectionEnableMode') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Allow RDP redirection of other supported RemoteFX USB devices from this computer
# Name: TS_USB_REDIRECTION_DISABLE
# Scope: Machine
# State: Enabled
# Source: TerminalServer.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client' -Name 'fUsbRedirectionEnableMode' -PropertyType 'DWord' -Value 2

History 2 retained releases

22H2 · 1.015 Jul 2024
- Translations changed; choose a language above to compare its wording.
1607 · 2.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

Template

Internal name: TS_USB_REDIRECTION_DISABLE
Namespace: Microsoft.Policies.TerminalServer
Template file: TerminalServer.admx
Release: Windows 10 22H2 · 1.0 · file set bc15f6a5271783ee…

Definition, editor controls and support

Definition

<policy class="Machine" clientExtension="{4bcd6cde-777b-48b6-9804-43568e23545d}" displayName="$(string.TS_USB_REDIRECTION_DISABLE)" explainText="$(string.TS_USB_REDIRECTION_EXPLAIN)" key="SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client" name="TS_USB_REDIRECTION_DISABLE" presentation="$(presentation.UsbAccessRight)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_USB_REDIRECTION" />
      <supportedOn ref="Microsoft.Policies.TerminalServer:TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1" />

      <elements>
        <enum id="UsbAccessRight" required="true" valueName="fUsbRedirectionEnableMode">
          <item displayName="$(string.UsbMode_AdminsOnly)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.UsbMode_AdminsAndUsers)">
            <value>
              <decimal value="2" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

Editor controls

<presentation id="UsbAccessRight" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <dropdownList defaultItem="1" refId="UsbAccessRight">RemoteFX USB Redirection Access Rights</dropdownList>
      </presentation>

Supported platforms and category

Microsoft.Policies.TerminalServer:category:TS_CLIENT
<category displayName="$(string.TS_CLIENT)" explainText="$(string.TS_CLIENT_HELP)" name="TS_CLIENT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_GP_NODE" />
    </category>
Microsoft.Policies.TerminalServer:category:TS_GP_NODE
<category displayName="$(string.TS_GP_NODE)" explainText="$(string.TS_User_Help)" name="TS_GP_NODE" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
Microsoft.Policies.TerminalServer:category:TS_USB_REDIRECTION
<category displayName="$(string.TS_USB_REDIRECTION)" explainText="$(string.TS_USB_REDIRECTION_Help)" name="TS_USB_REDIRECTION" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_CLIENT" />
    </category>
Microsoft.Policies.TerminalServer:definition:TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1
<definition displayName="$(string.TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1)" name="TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="2" ref="Microsoft.Policies.Products:WindowsServer2008_R2" />
          <range minVersionIndex="7" ref="Microsoft.Policies.Products:MicrosoftWindows7_RTM" />
        </or>
      </definition>
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:MicrosoftWindows7_RTM
<unresolved reference="Microsoft.Policies.Products:MicrosoftWindows7_RTM" />
Microsoft.Policies.TerminalServer:unresolved:Microsoft.Policies.Products:WindowsServer2008_R2
<unresolved reference="Microsoft.Policies.Products:WindowsServer2008_R2" />
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.TerminalServer:category:TS_CLIENT
<category displayName="$(string.TS_CLIENT)" explainText="$(string.TS_CLIENT_HELP)" name="TS_CLIENT" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_GP_NODE" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_CLIENT">Remote Desktop Connection Client</string><string id="Microsoft.Policies.TerminalServer:TS_CLIENT_HELP">Controls Remote Desktop Connection client settings</string></strings>
Microsoft.Policies.TerminalServer:category:TS_GP_NODE
<category displayName="$(string.TS_GP_NODE)" explainText="$(string.TS_User_Help)" name="TS_GP_NODE" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:WindowsComponents" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_GP_NODE">Remote Desktop Services</string><string id="Microsoft.Policies.TerminalServer:TS_User_Help">Controls configuration of Remote Desktop Services technologies that enable access to a server running Windows-based programs or the full Windows desktop</string></strings>
Microsoft.Policies.TerminalServer:category:TS_USB_REDIRECTION
<category displayName="$(string.TS_USB_REDIRECTION)" explainText="$(string.TS_USB_REDIRECTION_Help)" name="TS_USB_REDIRECTION" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.TerminalServer:TS_CLIENT" />
    </category>
<strings><string id="Microsoft.Policies.TerminalServer:TS_USB_REDIRECTION">RemoteFX USB Device Redirection</string><string id="Microsoft.Policies.TerminalServer:TS_USB_REDIRECTION_Help">Allow RDP redirection of other supported RemoteFX USB devices from this computer</string></strings>
Microsoft.Policies.TerminalServer:definition:TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1
<definition displayName="$(string.TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1)" name="TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="2" ref="Microsoft.Policies.Products:WindowsServer2008_R2" />
          <range minVersionIndex="7" ref="Microsoft.Policies.Products:MicrosoftWindows7_RTM" />
        </or>
      </definition>
<strings><string id="Microsoft.Policies.TerminalServer:TS_SUPPORTED_Windows7_OR_SERVER2K8R2_SP1">At least Windows 7 with Service Pack 1 or Windows Server 2008 R2 with Service Pack 1</string></strings>
Microsoft.Policies.Windows:category:WindowsComponents
<category displayName="$(string.WindowsComponents)" explainText="$(string.WindowsComponents_Help)" name="WindowsComponents" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:WindowsComponents">Windows Components</string><string id="Microsoft.Policies.Windows:WindowsComponents_Help">Contains settings for operating system components.</string></strings>