How to block USB devices and allow mouse and keyboard with a policy from the Symantec Endpoint Protection Manager (SEPM).

Symantec Endpoint Protection 14.x

Implement the following steps:

1. Log in to the SEP Manager console.
2. Select Policies, then Application and Device Control under Policies.
3. Select the Application and Device Control policy to be modified in the right-hand pane. 
4. Under Tasks, click Edit the Policy.
5. In the left pane, under Application and Device Control, click Device Control.
6. In the Blocked Devices section, click Add 
7. In the Device Selection window select USB, click OK.
   1. USB should now be listed under Device Name in the Blocked Devices section. 

To exclude the Mouse and Keyboard as blocked devices:    

1. In the right pane of the Application and Device Control policy window, select the Devices Excluded From Blocking section. Click Add.
2. In the Device Selection menu, click Human Interface Devices (Mice, etc.). Click OK.
   1. Assign the modified Application and Device Control policy to the appropriate Machine Groups.