Yeah, that error's a pain — you plug in a printer or a USB adapter and Windows just says "nope, not today." The good news: it's almost never a hardware failure. It's a policy that's blocking the install, and you can fix it in about two minutes.
The Quick Fix: Turn Off the Block
Open the Local Group Policy Editor. Hit Win + R, type gpedit.msc, and press Enter. If you're on Windows Home, skip to the registry method below — gpedit isn't there.
Now go to:
Computer Configuration > Administrative Templates > System > Device Installation > Device Installation RestrictionsLook for these two policies:
- Prevent installation of devices not described by other policy settings
- Prevent installation of devices using drivers that match these device setup classes
Double-click each one. If it's set to Enabled, change it to Not Configured and hit OK. If it's already Not Configured, check the one above it — Allow administrators to override Device Installation Restriction policies. Set that to Enabled if it's not.
Close gpedit and restart the device or replug your hardware. The install should pop up normally now.
If you're on Windows Home edition, you don't have gpedit. Use the registry instead:
regedit.exeNavigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\RestrictionsLook for a value named DenyDeviceIDs or DenyDeviceClasses. If they exist, delete them. Also check the Restrictions key itself — if there's a value called DenyUnspecified set to 1, set it to 0 or delete the whole key. Then restart.
Why This Works
That error code — 0x800F0248 — literally translates to "The installation of this device is forbidden by system policy." It's not a driver problem or a broken port. Windows is just following orders from a Group Policy object, whether that's a leftover from an IT admin, a security suite, or a script that ran months ago.
I've seen this on a client's domain-joined laptop where the corporate policy blocked all USB mass storage. The user plugged in a label printer and got this exact error. Once we unblocked it from the server-side GPO, it worked instantly. On a standalone PC, it's usually a local policy that got flipped accidentally — maybe you ran a "hardening" script or someone enabled "Prevent installation of devices not described..." by mistake.
Less Common Variations
Sometimes the block is more specific. Check if the policy references a specific device class or ID. In gpedit, under the same Restrictions folder, there's Also apply to devices that are already present — that one can block existing devices too. If your device worked before and then stopped, check that.
Another sneaky one: third-party security software (like some endpoint protection tools) injects its own policy. If the registry fix doesn't stick, uninstall or disable the security tool temporarily and test again. I had a client whose antivirus kept re-adding the block every reboot — we had to whitelist the device in the AV's control panel.
Also, if you're on a domain network, the real fix is on the server. Local policy changes get overwritten by the domain GPO on next refresh. You'll need to talk to whoever manages Active Directory.
Prevention: Keep It From Coming Back
Once you've cleared the block, figure out why it was there in the first place. If it was enabled intentionally by an admin, you're fighting the system — better to get the device approved through proper channels.
If it was accidental or leftover, make sure no scripts re-enable it. Also, don't run random "optimizer" tools that modify Group Policy. I've seen those set every restriction to Enabled "for security" and break half the peripherals in the office.
Finally, if you're the admin, use the policy Allow installation of devices using drivers that match these device setup classes to whitelist specific device classes instead of blocking everything. That way you keep the control but don't lock down every new gadget that comes in.
That's it. You're back in business.