Intune自定义OMA-URI阻止USB存储误阻网络共享打印机求助

我花费数日排查，发现Intune中自定义的OMA-URI USB策略不仅按预期阻止了未批准的USB打印机，还错误地导致网络共享打印机显示“已断开连接”。未应用该策略的设备，通过USB共享的打印机运行完全正常。

我的需求是：仅阻止所有未批准的USB设备，同时允许网络共享打印机正常打印。

已配置的策略详情 #

可移动介质组XML #

OMA-URI: ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7b56779d19-346e-4219-81a0-8b6a0a35a348%7d/GroupData

<Group Id="{56779d19-346e-4219-81a0-8b6a0a35a348}">
<!-- ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7b56779d19-346e-4219-81a0-8b6a0a35a348%7d/GroupData -->
    <MatchType>MatchAny</MatchType>
    <DescriptorIdList>
        <PrimaryId>RemovableMediaDevices</PrimaryId>
    </DescriptorIdList>
</Group>

USB批准组XML（已成功允许指定USB设备） #

OMA-URI: ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7bf1d51d30-cf1e-453d-a275-152a770b1f83%7d/GroupData

<Group Id="{f1d51d30-cf1e-453d-a275-152a770b1f83}">
<!-- ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/%7bf1d51d30-cf1e-453d-a275-152a770b1f83%7d/GroupData -->
    <Matchtype>Matchany</Matchtype>
    <DescriptorIdlist>
<InstancePathId>USBSTOR\DISK&amp;VEN_TTULTRA&amp;PROD_SENSITECH_INC.&amp;REV_\7&amp;8D3D3A7&amp;0&amp;00000000001A&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_ATMEL&amp;PROD_ON-CHIP_VIRTUAL&amp;REV_1.00\7&amp;D039C83&amp;0&amp;123123123123&amp;0</InstancePathId>
<InstancePathId>USBSTOR\DISK&amp;VEN_GENERIC&amp;PROD_USB_FLASH_DISK&amp;REV_0.00\__0XFFFFFFFFFFFFFFFF&amp;0</InstancePathId>
    </DescriptorIdlist>
</Group>

Intune允许策略XML #

OMA-URI: ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7baa5767cd-852d-45c4-8409-7adc0147dd45%7d/RuleData

<PolicyRule Id="{aa5767cd-852d-45c4-8409-7adc0147dd45}">
<!-- ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7baa5767cd-852d-45c4-8409-7adc0147dd45%7d/RuleData -->
    <Name>Allow Write and Execute to Removable Storage</Name>
    <IncludedIdList>
        <GroupId>{f1d51d30-cf1e-453d-a275-152a770b1f83}</GroupId>
    </IncludedIdList>
    <ExcludedIdList>
    </ExcludedIdList>
    <Entry Id="{1f910990-dd5d-4a99-a75b-3b460b16ce57}">
        <Type>Allow</Type>
        <Options>16</Options>
        <AccessMask>63</AccessMask>
    </Entry>
</PolicyRule>

限制策略XML #

OMA-URI: ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7b6edabff0-b59f-40db-b1fd-d94807c0bb87%7d/RuleData

<PolicyRule Id="{6edabff0-b59f-40db-b1fd-d94807c0bb87}">
<!-- ./Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/%7b6edabff0-b59f-40db-b1fd-d94807c0bb87%7d/RuleData -->
    <Name>Block Write and Execute to Removable Storage</Name>
    <IncludedIdList>
        <GroupId>{56779d19-346e-4219-81a0-8b6a0a35a348}</GroupId>
    </IncludedIdList>
    <ExcludedIdList>
        <GroupId>{f1d51d30-cf1e-453d-a275-152a770b1f83}</GroupId>
    </ExcludedIdList>
    <Entry Id="{bab49e44-9fc9-44d0-8937-8f7c8c17a290}">
        <Type>Deny</Type>
        <Options>0</Options>
        <AccessMask>3</AccessMask>
    </Entry>
</PolicyRule>

当前策略可正常阻止未批准USB设备，并允许预先添加到“USB批准组”中的设备，但误影响了网络共享打印机。怀疑是配置遗漏，寻求修正方案。

内容的提问来源于stack exchange，提问作者Tres06