Device Installation Restrictions: Allowed USB Instance ID remains blocked until manually uninstalled in Device Manager

Environment

OS: Windows 10 / Windows 11 Enterprise (22H2 / 23H2)

Execution Context: Automated Deployment via Endpoint Management (BigFix / Scripted Batch)

Issue Summary

We are configuring granular USB storage policies using Registry-based Device Installation Restrictions (HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions).

While global blocking works immediately, adding a specific target hardware ID to the allowlist (AllowInstanceIDs) does not dynamically unblock an already-connected USB drive. Even after updating the registry, forcing Group Policy (gpupdate /force), and re-scanning PnP devices (pnputil /scan-devices), Windows maintains the restriction block flag on the device node.

The allowed USB only begins working after manually opening Device Manager, right-clicking the device, selecting "Uninstall Device", and triggering "Scan for hardware changes."

Registry Configuration Applied

Code snippet

[HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions]
"AllowDenyLayered"=dword:00000001
"DenyDeviceIDs"=dword:00000001
"DenyDeviceIDsRetroactive"=dword:00000001
"AllowInstanceIDs"=dword:00000001

[HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs]
"1"="USBSTOR\\GenDisk"

[HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\AllowInstanceIDs]
"1"="USBSTOR\\DISK&VEN_...\\..."

Steps to Reproduce

Apply the BLOCK policy registry keys and run gpupdate /force.

Insert a standard USB drive — device is blocked as expected.

Add the target USB's explicit Instance ID to AllowInstanceIDs.

Trigger gpupdate /force /wait:30 and run pnputil /scan-devices.

Observed Result: The drive remains disabled/blocked in Device Manager with a policy restriction flag.

Perform manual UI intervention: Device Manager -> Uninstall Device on the blocked node -> Scan for hardware changes.

Observed Result: Windows immediately installs the device and grants access.

Questions

1. Is there an officially supported API, PowerShell cmdlet, or command-line utility to force the Windows Plug and Play (PnP) Manager to clear cached policy block flags and re-evaluate DeviceInstall\Restrictions without requiring a full device node uninstall?

Why does pnputil /remove-device targeted at USBSTOR fail to reset the policy flag on the parent USB composite device node?

Environment

OS: Windows 10 / Windows 11 Enterprise (22H2 / 23H2)

  __Execution Context:__ Automated Deployment via Endpoint Management (BigFix / Scripted Batch)
  
  ### Issue Summary

  We are configuring granular USB storage policies using Registry-based Device Installation Restrictions (`HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions`).
  
  While global blocking works immediately, adding a specific target hardware ID to the allowlist (`AllowInstanceIDs`) does not dynamically unblock an already-connected USB drive. Even after updating the registry, forcing Group Policy (`gpupdate /force`), and re-scanning PnP devices (`pnputil /scan-devices`), Windows maintains the restriction block flag on the device node.
  
  The allowed USB only begins working __after manually opening Device Manager, right-clicking the device, selecting "Uninstall Device", and triggering "Scan for hardware changes."__
  
  ### Registry Configuration Applied

  Code snippet
  ```
  [HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions]

"AllowDenyLayered"=dword:00000001 "DenyDeviceIDs"=dword:00000001 "DenyDeviceIDsRetroactive"=dword:00000001 "AllowInstanceIDs"=dword:00000001

[HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\DenyDeviceIDs] "1"="USBSTOR\GenDisk"

[HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions\AllowInstanceIDs] "1"="USBSTOR\DISK&VEN_...\..." ```

  ### Steps to Reproduce

     Apply the __BLOCK__ policy registry keys and run `gpupdate /force`.
     
        Insert a standard USB drive — device is blocked as expected.
        
           Add the target USB's explicit Instance ID to `AllowInstanceIDs`.
           
              Trigger `gpupdate /force /wait:30` and run `pnputil /scan-devices`.
              
                 __Observed Result:__ The drive remains disabled/blocked in Device Manager with a policy restriction flag.
                 
                    Perform manual UI intervention: __Device Manager__ -> __Uninstall Device__ on the blocked node -> __Scan for hardware changes__.
                    
                       __Observed Result:__ Windows immediately installs the device and grants access.
                       
                       ### Questions

                          Is there an officially supported API, PowerShell cmdlet, or command-line utility to force the Windows Plug and Play (PnP) Manager to clear cached policy block flags and re-evaluate `DeviceInstall\Restrictions` without requiring a full device node uninstall?
                          
                             Why does `pnputil /remove-device` targeted at `USBSTOR` fail to reset the policy flag on the parent USB composite device node?