USBBlocker.ps1

<#
.SYNOPSIS
    Block/unblock USB flash drives and external storage while keeping mouse, keyboard, audio and other USB peripherals working.

.DESCRIPTION
    Operates on the USB storage class drivers:
      - USBSTOR    : USB sticks, standard external HDD/SSD
      - UASPStor   : high-performance USB 3.x drives (USB Attached SCSI)
      - WpdBusEnum : Windows Portable Devices (smartphones in MTP/PTP mode)

    Peripherals left untouched (different drivers): mouse, keyboard, webcam, USB audio,
    printers, wireless dongles, smart card readers, joysticks, etc.

.PARAMETER Block
    Disables the USB storage drivers. Drives already mounted stay available until
    they are disconnected; new ones are rejected.

.PARAMETER Unblock
    Re-enables the USB storage drivers.

.PARAMETER Status
    Shows the current driver state.

.EXAMPLE
    .\USBBlocker.ps1 -Block
    .\USBBlocker.ps1 -Unblock
    .\USBBlocker.ps1 -Status
#>

[CmdletBinding(DefaultParameterSetName='Status')]
param(
    [Parameter(ParameterSetName='Block',   Mandatory)] [switch]$Block,
    [Parameter(ParameterSetName='Unblock', Mandatory)] [switch]$Unblock,
    [Parameter(ParameterSetName='Status')]             [switch]$Status
)

$ErrorActionPreference = 'Stop'

$Drivers = @(
    @{ Name = 'USBSTOR';     Description = 'USB Mass Storage (sticks, external HDDs)' },
    @{ Name = 'UASPStor';    Description = 'USB Attached SCSI (fast USB 3.x drives)' },
    @{ Name = 'WpdBusEnum';  Description = 'Windows Portable Devices (MTP/PTP phones)' }
)

$LogFile = Join-Path $PSScriptRoot 'usbblocker.log'

function Write-Log {
    param([string]$Message, [string]$Level = 'INFO')
    $ts = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
    $line = "[$ts] [$Level] $Message"
    Add-Content -Path $LogFile -Value $line -Encoding utf8
    switch ($Level) {
        'ERROR' { Write-Host $line -ForegroundColor Red }
        'WARN'  { Write-Host $line -ForegroundColor Yellow }
        'OK'    { Write-Host $line -ForegroundColor Green }
        default { Write-Host $line }
    }
}

function Test-Admin {
    $id = [Security.Principal.WindowsIdentity]::GetCurrent()
    $p  = New-Object Security.Principal.WindowsPrincipal($id)
    return $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

function Get-DriverStartValue {
    param([string]$Name)
    $path = "HKLM:\SYSTEM\CurrentControlSet\Services\$Name"
    if (-not (Test-Path $path)) { return $null }
    return (Get-ItemProperty -Path $path -Name 'Start' -ErrorAction SilentlyContinue).Start
}

function Set-DriverStartValue {
    param([string]$Name, [int]$Value)
    $path = "HKLM:\SYSTEM\CurrentControlSet\Services\$Name"
    if (-not (Test-Path $path)) {
        Write-Log "Driver $Name not present on this system, skipping" 'WARN'
        return $false
    }
    Set-ItemProperty -Path $path -Name 'Start' -Value $Value
    return $true
}

function Show-Status {
    Write-Host ''
    Write-Host '=== USB storage driver status ===' -ForegroundColor Cyan
    foreach ($d in $Drivers) {
        $val = Get-DriverStartValue -Name $d.Name
        $state = switch ($val) {
            0       { 'BOOT (always on)' }
            1       { 'SYSTEM (on)' }
            2       { 'AUTO (on)' }
            3       { 'DEMAND (on-demand) - UNBLOCKED' }
            4       { 'DISABLED - BLOCKED' }
            $null   { 'not present' }
            default { "unknown value: $val" }
        }
        $color = if ($val -eq 4) { 'Red' } elseif ($null -eq $val) { 'DarkGray' } else { 'Green' }
        Write-Host ("  {0,-12} {1,-50} [{2}]" -f $d.Name, $d.Description, $state) -ForegroundColor $color
    }
    Write-Host ''
}

# === Main ===

if ($PSCmdlet.ParameterSetName -eq 'Status' -or $Status) {
    Show-Status
    return
}

if (-not (Test-Admin)) {
    Write-Log 'This script requires administrator privileges. Re-run it from an elevated PowerShell.' 'ERROR'
    exit 1
}

$newValue = if ($Block) { 4 } else { 3 }
$action   = if ($Block) { 'BLOCK'  } else { 'UNBLOCK' }

Write-Log "Starting USB storage driver $action" 'INFO'

foreach ($d in $Drivers) {
    try {
        $ok = Set-DriverStartValue -Name $d.Name -Value $newValue
        if ($ok) {
            Write-Log "$($d.Name) -> Start=$newValue ($($d.Description))" 'OK'
        }
    } catch {
        Write-Log "Error on $($d.Name): $_" 'ERROR'
    }
}

Write-Log "$action complete. Devices already mounted stay accessible until disconnected." 'OK'
Write-Host ''
Show-Status