Temporarily allow USB access for specific macOS users in HexnodeSolved

On macOS, USB pen drive restrictions in Hexnode are usually configured through Media Management, not through a general admin permission setting. To identify the policy blocking USB access:

1. Go to Manage > Devices.
2. Open the affected Mac.
3. Go to the Policies tab for that device.
4. Open each active macOS policy listed there.
5. Check macOS > Security > Media Management.
6. Look under the External Media section.

The policy responsible for blocking USB storage will have Deny all use of external media enabled. Once you identify the policy, check its Policy Targets tab. The way to temporarily allow access depends on how the policy is assigned:

• If the policy is assigned directly to users or devices: edit the Policy Targets and remove the required users/devices, or remove the policy from the device under Manage > Devices > select device > Policies.
• If the policy is assigned through a device group or user group: remove the users/devices from that group temporarily. If you only remove the policy from the device, it may get reapplied automatically because the device still belongs to the targeted group.

After the blocking policy is no longer associated with the Mac, the USB restriction should be lifted automatically on the devic

I ran into the same confusion before. The policy name didn’t clearly say “USB block” in my case either. I had to open the policies one by one from the device’s Policies tab and check the macOS payloads inside them. The setting was under Media Management, not under a generic USB option.

If you are seeing a policy named something like USB restricted mode, that is likely a good candidate to inspect first. Open that policy and check whether it contains macOS > Security > Media Management with Deny all use of external media enabled. Also, make sure you are checking the configuration inside the policy, not just the policy name. The External Media section appears only when the Media Management payload is configured in that policy. If a policy does not include Media Management, it will not show that section.

That makes sense. I was looking for a separate exclusion option inside the policy and couldn’t find one. So if the policy is coming from a group, I need to remove the device or user from that group instead of just deleting the policy from the device, right?

Correct. Hexnode does not use a separate exclusion tab inside the policy for this case.

If the USB block policy is inherited from a group, removing it directly from the device will not be enough because the device can receive the policy again from the same group. For temporary access, remove the specific user/device from the targeted user group or device group. When access should be restricted again, add them back to the group.

If the policy was directly assigned, you can remove only those users/devices from the Policy Targets tab instead.