[ BUG ] `Copy-FalconDeviceControlPolicy` doesn't copy exceptions or settings

[tdepaola]

Describe the bug
When Copy-FalconDeviceControlPolicy, the policy is created, but the setting duplication seems to fail (no error).
Existing USB exceptions are not copied, and class default action (block_all, read only, etc.) is not applied

To Reproduce
Try to copy a Device Controle policy with exception and block_all action for some classes

Expected behavior
When a policy is copied, all its settings are (it was working in 2.2.8)

Environment (please complete the following information):

• OS: Windows 11
• PowerShell: 7.5.4
• PSFalcon: 2.2.9

Additional context
N/A

Transcript content

PS>. '.\UsbSendingTools-v3.dev.ps1' -Entity 'TEST ENV' -hostname 'VM-TEST' -CaseNumber '123456' -Policy 2 -CombinedID '1234_12345_123456' -Classes 1 -TempException 2 

VERBOSE: 03:41:42 [Get-FalconHost] /devices/combined/devices/v1:get
VERBOSE: 03:41:42 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/devices/combined/devices/v1?filter=hostname%3A%5B%27VM-TEST%27%5D&fields=device_id%2Chostname
VERBOSE: 03:41:42 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:42 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:42 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:43 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=6337589e-8abb-4b2c-9f1c-b77982a210c5, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:42 [Write-Result] query_time=0,067318999, pagination.total=1, pagination.limit=100, pagination.offset=, powered_by=device-api, trace_id=6337589e-8abb-4b2c-9f1c-b77982a210c5
VERBOSE: 03:41:42 [Get-FalconDeviceControlPolicy] /policy/queries/device-control/v1:get
VERBOSE: 03:41:42 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/policy/queries/device-control/v1?filter=platform_name%3A%27Windows%27%2Bname%3A%21%27platform_default%27
VERBOSE: 03:41:42 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:42 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:42 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:43 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=f27109fd-6ade-4597-ad3b-e502c8819ac7, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:42 [Write-Result] query_time=0,013687416, pagination.offset=0, pagination.limit=100, pagination.total=2, trace_id=f27109fd-6ade-4597-ad3b-e502c8819ac7
VERBOSE: 03:41:42 [Get-FalconDeviceControlPolicy] /policy/entities/device-control/v2:get
VERBOSE: 03:41:42 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/policy/entities/device-control/v2?ids=65b2c848b3744a29a3d5f6f41b49a552&ids=40bc6db89afc4adc9684bcd73c3b70c3
VERBOSE: 03:41:42 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:43 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:43 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:44 GMT, Transfer-Encoding=chunked, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=a21701a6-7893-4990-a053-a0cd9aa4b457, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:43 [Write-Result] query_time=0,00023602, powered_by=, trace_id=a21701a678934990a053a0cd9aa4b457
VERBOSE: 03:41:43 [Get-FalconHostGroup] /devices/combined/host-groups/v1:get
VERBOSE: 03:41:43 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/devices/combined/host-groups/v1
VERBOSE: 03:41:43 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:43 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:43 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:44 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=984f4fb0-20e1-4470-823f-a03695915d23, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:43 [Write-Result] query_time=0,027220208, pagination.offset=5, pagination.limit=100, pagination.total=5, trace_id=984f4fb0-20e1-4470-823f-a03695915d23
VERBOSE: 03:41:43 [Get-FalconDeviceControlPolicy] /policy/entities/device-control/v2:get
VERBOSE: 03:41:43 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/policy/entities/device-control/v2?ids=40bc6db89afc4adc9684bcd73c3b70c3
VERBOSE: 03:41:43 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:43 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:43 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:44 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=08fa2b1b-88b7-49ca-9922-b3adcdbe662f, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:43 [Write-Result] query_time=0,000200287, powered_by=, trace_id=08fa2b1b88b749ca9922b3adcdbe662f
VERBOSE: 03:41:43 [New-FalconDeviceControlPolicy] /policy/entities/device-control/v2:post
VERBOSE: 03:41:43 [ApiClient.Invoke] POST https://api.eu-1.crowdstrike.com/policy/entities/device-control/v2
VERBOSE: 03:41:43 [ApiClient.Invoke] Accept=application/json, ContentType=application/json
VERBOSE: 03:41:43 [ApiClient.Invoke] {"policies":[{"bluetooth_settings":null,"clone_id":null,"description":"123456","name":"TEST ENV - DEVICE CONTROL - VM-TEST","platform_name":"Windows","usb_settings":{"enforcement_mode":"MONITOR_ENFORCE","end_user_notification":"SILENT","custom_notifications":{"blocked_notification":{"use_custom":false,"custom_message":"Your removable device is blocked by your organization's policy"},"restricted_notification":{"use_custom":false,"custom_message":"Functions of your removable device are restricted by your organization's policy"}},"classes":[{"id":"693dc009237c4eaf8b819fc476f6afb0","class":"ANY","action":"BLOCK_ALL","exceptions":[{"id":"f9f218dc6de24b008cc3574ab9d32a87","class":"ANY","vendor_name":null,"vendor_id":"1","product_id":"2","serial_number":"3","combined_id":"1_2_3","action":"FULL_ACCESS","match_method":"COMBINED_ID","created_timestamp":"2025-11-11T14:01:37.387531207Z","modified_timestamp":"2025-11-11T14:01:37.387531207Z"},{"id":"01c6604db9b94bc88dee7a910a474fa1","class":"ANY","vendor_name":null,"vendor_id":"2","product_id":"3","serial_number":"4000","combined_id":"2_3_4000","action":"FULL_ACCESS","match_method":"COMBINED_ID","created_timestamp":"2025-11-11T14:01:37.38753984Z","modified_timestamp":"2025-11-11T14:01:37.38753984Z"}]},{"id":"dd9c806ca79c456e944182437a55feae","class":"AUDIO_VIDEO","action":"FULL_ACCESS","exceptions":[]},{"id":"7203bcc7248144bdbcec1a877015b1ea","class":"IMAGING","action":"FULL_ACCESS","exceptions":[]},{"id":"7a49f7a578bb4dd597e8baaee1eb70e3","class":"MASS_STORAGE","action":"BLOCK_ALL","exceptions":[{"id":"89350c12aa824a74a6884242f8d23eb8","class":"MASS_STORAGE","vendor_name":null,"vendor_id":"123","action":"FULL_ACCESS","match_method":"VID","created_timestamp":"2025-11-11T14:02:31.119351987Z","modified_timestamp":"2025-11-11T14:02:31.119351987Z"},{"id":"266f03a0bd754f73b715cbfde944b50d","class":"MASS_STORAGE","vendor_name":"ITT Canon","vendor_id":"34148","product_name":"StoreJet 25H3","product_id":"28672","serial_number":"*","action":"FULL_ACCESS","match_method":"VID_PID_SERIALWC","created_timestamp":"2025-11-11T14:02:31.119359252Z","modified_timestamp":"2025-11-11T14:02:31.119359252Z","use_wildcard":true}]},{"id":"52c01c29cfe847229e30db8bac290f6e","class":"MOBILE","action":"BLOCK_ALL","exceptions":[{"id":"235ea23bcd05419086ba33a992891a31","class":"MOBILE","vendor_name":null,"vendor_id":"2","product_id":"3","serial_number":"4","combined_id":"2_3_4","action":"FULL_ACCESS","match_method":"COMBINED_ID","created_timestamp":"2025-11-11T13:42:05.937431036Z","modified_timestamp":"2025-11-11T13:42:05.937431036Z"}]},{"id":"bcfb93f6fbb54a4b963c472c0373f9ef","class":"PRINTER","action":"FULL_ACCESS","exceptions":[]},{"id":"0a9f6f5f4de34cd797f360698cdfd8f1","class":"WIRELESS","action":"FULL_ACCESS","exceptions":[]},{"id":"c68529b12ea24082b7d26e7fefa41bfe","class":"REMOVABLE_STORAGE_SDCARD","action":"FULL_ACCESS","exceptions":[]}],"whitelist_mode":"DISABLE_VIRTUAL","enhanced_file_metadata":false,"pcie_enforcement_mode":"MONITOR_ONLY"}}]}
VERBOSE: 03:41:44 [ApiClient.Invoke] 201: Created
VERBOSE: 03:41:44 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:45 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=dc8b4640-c301-4513-af8b-74db87cd592d, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:44 [Write-Result] query_time=0,000263597, powered_by=, trace_id=dc8b4640c3014513af8b74db87cd592d
VERBOSE: 03:41:44 [Edit-FalconDeviceControlPolicy] /policy/entities/device-control/v2:patch
VERBOSE: 03:41:44 [ApiClient.Invoke] PATCH https://api.eu-1.crowdstrike.com/policy/entities/device-control/v2
VERBOSE: 03:41:44 [ApiClient.Invoke] Accept=application/json, ContentType=application/json
VERBOSE: 03:41:44 [ApiClient.Invoke] {"policies":[{"description":"123456","id":"06905c9371fb4600808ad7caa4a233e3","name":"TEST ENV - DEVICE CONTROL - VM-TEST","usb_settings":{"enforcement_mode":"MONITOR_ENFORCE","end_user_notification":"SILENT","custom_notifications":{"blocked_notification":{"use_custom":false,"custom_message":"Your removable device is blocked by your organization's policy"},"restricted_notification":{"use_custom":false,"custom_message":"Functions of your removable device are restricted by your organization's policy"}},"classes":[{"id":"693dc009237c4eaf8b819fc476f6afb0","class":"ANY","action":"BLOCK_ALL","exceptions":[{"id":"f9f218dc6de24b008cc3574ab9d32a87","class":"ANY","vendor_name":null,"vendor_id":"1","product_id":"2","serial_number":"3","combined_id":"1_2_3","action":"FULL_ACCESS","match_method":"COMBINED_ID","created_timestamp":"2025-11-11T14:01:37.387531207Z","modified_timestamp":"2025-11-11T14:01:37.387531207Z"},{"id":"01c6604db9b94bc88dee7a910a474fa1","class":"ANY","vendor_name":null,"vendor_id":"2","product_id":"3","serial_number":"4000","combined_id":"2_3_4000","action":"FULL_ACCESS","match_method":"COMBINED_ID","created_timestamp":"2025-11-11T14:01:37.38753984Z","modified_timestamp":"2025-11-11T14:01:37.38753984Z"}]},{"id":"dd9c806ca79c456e944182437a55feae","class":"AUDIO_VIDEO","action":"FULL_ACCESS","exceptions":[]},{"id":"7203bcc7248144bdbcec1a877015b1ea","class":"IMAGING","action":"FULL_ACCESS","exceptions":[]},{"id":"7a49f7a578bb4dd597e8baaee1eb70e3","class":"MASS_STORAGE","action":"BLOCK_ALL","exceptions":[{"id":"89350c12aa824a74a6884242f8d23eb8","class":"MASS_STORAGE","vendor_name":null,"vendor_id":"123","action":"FULL_ACCESS","match_method":"VID","created_timestamp":"2025-11-11T14:02:31.119351987Z","modified_timestamp":"2025-11-11T14:02:31.119351987Z"},{"id":"266f03a0bd754f73b715cbfde944b50d","class":"MASS_STORAGE","vendor_name":"ITT Canon","vendor_id":"34148","product_name":"StoreJet 25H3","product_id":"28672","serial_number":"*","action":"FULL_ACCESS","match_method":"VID_PID_SERIALWC","created_timestamp":"2025-11-11T14:02:31.119359252Z","modified_timestamp":"2025-11-11T14:02:31.119359252Z","use_wildcard":true}]},{"id":"52c01c29cfe847229e30db8bac290f6e","class":"MOBILE","action":"BLOCK_ALL","exceptions":[{"id":"235ea23bcd05419086ba33a992891a31","class":"MOBILE","vendor_name":null,"vendor_id":"2","product_id":"3","serial_number":"4","combined_id":"2_3_4","action":"FULL_ACCESS","match_method":"COMBINED_ID","created_timestamp":"2025-11-11T13:42:05.937431036Z","modified_timestamp":"2025-11-11T13:42:05.937431036Z"}]},{"id":"bcfb93f6fbb54a4b963c472c0373f9ef","class":"PRINTER","action":"FULL_ACCESS","exceptions":[]},{"id":"0a9f6f5f4de34cd797f360698cdfd8f1","class":"WIRELESS","action":"FULL_ACCESS","exceptions":[]},{"id":"c68529b12ea24082b7d26e7fefa41bfe","class":"REMOVABLE_STORAGE_SDCARD","action":"FULL_ACCESS","exceptions":[]}],"whitelist_mode":"DISABLE_VIRTUAL","enhanced_file_metadata":false,"pcie_enforcement_mode":"MONITOR_ONLY"}}]}
VERBOSE: 03:41:45 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:45 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:46 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=e787078c-f583-4b95-97a9-9556cb269b18, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:45 [Write-Result] query_time=0,000154798, powered_by=, trace_id=e787078cf5834b9597a99556cb269b18
VERBOSE: 03:41:45 [Invoke-FalconDeviceControlPolicyAction] /policy/entities/device-control-actions/v1:post
VERBOSE: 03:41:45 [ApiClient.Invoke] POST https://api.eu-1.crowdstrike.com/policy/entities/device-control-actions/v1?action_name=enable
VERBOSE: 03:41:45 [ApiClient.Invoke] Accept=application/json, ContentType=application/json
VERBOSE: 03:41:45 [ApiClient.Invoke] {"ids":["06905c9371fb4600808ad7caa4a233e3"]}
VERBOSE: 03:41:45 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:45 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:46 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=5a559178-0180-4eae-b73a-0d23ac63362e, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:45 [Write-Result] query_time=0,111031734, trace_id=5a559178-0180-4eae-b73a-0d23ac63362e
VERBOSE: 03:41:45 [Get-FalconDeviceControlPolicy] /policy/queries/device-control/v1:get
VERBOSE: 03:41:45 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/policy/queries/device-control/v1?filter=name%3A~%27TEST%20ENV%20-%20DEVICE%20CONTROL%20-%20VM-TEST%27
VERBOSE: 03:41:45 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:45 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:45 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:46 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=c9d21d19-dd0f-4b13-a4ec-f13fb06b437b, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:45 [Write-Result] query_time=0,075270107, pagination.offset=0, pagination.limit=100, pagination.total=1, trace_id=c9d21d19-dd0f-4b13-a4ec-f13fb06b437b
VERBOSE: 03:41:45 [Get-FalconDeviceControlPolicy] /policy/entities/device-control/v2:get
VERBOSE: 03:41:45 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/policy/entities/device-control/v2?ids=06905c9371fb4600808ad7caa4a233e3
VERBOSE: 03:41:45 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:45 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:45 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:46 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=db9a8feb-1748-4941-8518-88949a48163a, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:45 [Write-Result] query_time=0,00017495, powered_by=, trace_id=db9a8feb17484941851888949a48163a
The policy 'TEST ENV - DEVICE CONTROL - VM-TEST' has been created.

VERBOSE: 03:41:45 [Get-FalconHostGroup] /devices/combined/host-groups/v1:get
VERBOSE: 03:41:45 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/devices/combined/host-groups/v1
VERBOSE: 03:41:45 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:45 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:45 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:46 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=69944e6f-79e1-49e6-b072-ce5286d963f5, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:45 [Write-Result] query_time=0,156145549, pagination.offset=5, pagination.limit=100, pagination.total=5, trace_id=69944e6f-79e1-49e6-b072-ce5286d963f5
The group 'TEST ENV - DEVICE CONTROL - VM-TEST' already exists. So, it's not added

VERBOSE: 03:41:45 [Invoke-FalconHostGroupAction] /devices/entities/host-group-actions/v1:post
VERBOSE: 03:41:45 [ApiClient.Invoke] POST https://api.eu-1.crowdstrike.com/devices/entities/host-group-actions/v1?action_name=add-hosts
VERBOSE: 03:41:45 [ApiClient.Invoke] Accept=application/json, ContentType=application/json
VERBOSE: 03:41:45 [ApiClient.Invoke] {"ids":["a57c9fad66324ff2928741357816a022"],"action_parameters":[{"name":"filter","value":"(device_id:['1c3c8688cecb4aaa9d02a0b4e8a3fecd'])"}]}
VERBOSE: 03:41:48 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:48 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:49 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=b1f9e5d3-5f92-473a-824b-4a2b09b4518c, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:48 [Write-Result] query_time=2,921953223, trace_id=b1f9e5d3-5f92-473a-824b-4a2b09b4518c
VERBOSE: 03:41:48 [Invoke-FalconDeviceControlPolicyAction] /policy/entities/device-control-actions/v1:post
VERBOSE: 03:41:48 [ApiClient.Invoke] POST https://api.eu-1.crowdstrike.com/policy/entities/device-control-actions/v1?action_name=add-host-group
VERBOSE: 03:41:48 [ApiClient.Invoke] Accept=application/json, ContentType=application/json
VERBOSE: 03:41:48 [ApiClient.Invoke] {"ids":["06905c9371fb4600808ad7caa4a233e3"],"action_parameters":[{"name":"group_id","value":"a57c9fad66324ff2928741357816a022"}]}
VERBOSE: 03:41:49 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:49 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:50 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=ed97c839-5248-4012-8448-8f1ed4d4276d, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:49 [Write-Result] query_time=0,358176969, trace_id=ed97c839-5248-4012-8448-8f1ed4d4276d
The group 'TEST ENV - DEVICE CONTROL - VM-TEST' has been added to the policy 'TEST ENV - DEVICE CONTROL - VM-TEST'

VERBOSE: 03:41:49 [Get-FalconDeviceControlPolicy] /policy/queries/device-control/v1:get
VERBOSE: 03:41:49 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/policy/queries/device-control/v1?filter=platform_name%3A%27Windows%27%2Bname%3A%21%27platform_default%27
VERBOSE: 03:41:49 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:49 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:49 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:50 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=4f483148-e542-47c3-b3c1-245d2d0ac406, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:49 [Write-Result] query_time=0,006920485, pagination.offset=0, pagination.limit=100, pagination.total=3, trace_id=4f483148-e542-47c3-b3c1-245d2d0ac406
VERBOSE: 03:41:49 [Get-FalconDeviceControlPolicy] /policy/entities/device-control/v2:get
VERBOSE: 03:41:49 [ApiClient.Invoke] GET https://api.eu-1.crowdstrike.com/policy/entities/device-control/v2?ids=65b2c848b3744a29a3d5f6f41b49a552&ids=40bc6db89afc4adc9684bcd73c3b70c3&ids=06905c9371fb4600808ad7caa4a233e3
VERBOSE: 03:41:49 [ApiClient.Invoke] Accept=application/json
VERBOSE: 03:41:49 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:49 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:50 GMT, Transfer-Encoding=chunked, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=34cd739a-4e77-46f5-8f4a-756a71113b4a, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:49 [Write-Result] query_time=0,000253522, powered_by=, trace_id=34cd739a4e7746f58f4a756a71113b4a
VERBOSE: 03:41:49 [Set-FalconDeviceControlPrecedence] /policy/entities/device-control-precedence/v1:post
VERBOSE: 03:41:49 [ApiClient.Invoke] POST https://api.eu-1.crowdstrike.com/policy/entities/device-control-precedence/v1
VERBOSE: 03:41:49 [ApiClient.Invoke] Accept=application/json, ContentType=application/json
VERBOSE: 03:41:49 [ApiClient.Invoke] {"platform_name":"Windows","ids":["65b2c848b3744a29a3d5f6f41b49a552","06905c9371fb4600808ad7caa4a233e3","40bc6db89afc4adc9684bcd73c3b70c3"]}
VERBOSE: 03:41:49 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:49 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:50 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=6a349db9-1cc3-4df6-b682-0be684286da2, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:49 [Write-Result] query_time=0,080878652, writes=, trace_id=6a349db9-1cc3-4df6-b682-0be684286da2

VERBOSE: 03:41:49 [Edit-FalconDeviceControlClass] /policy/entities/device-control-classes/v1:patch
VERBOSE: 03:41:49 [ApiClient.Invoke] PATCH https://api.eu-1.crowdstrike.com/policy/entities/device-control-classes/v1
VERBOSE: 03:41:49 [ApiClient.Invoke] Accept=application/json, ContentType=application/json
VERBOSE: 03:41:49 [ApiClient.Invoke] {"policies":[{"usb_classes":{"upsert_exceptions":[{"combined_id":"1234_12345_123456","class":"ANY","action":"FULL_ACCESS"}]},"id":"06905c9371fb4600808ad7caa4a233e3"}]}
VERBOSE: 03:41:50 [ApiClient.Invoke] 200: OK
VERBOSE: 03:41:50 [ApiClient.Invoke] Server=nginx, Date=Fri, 14 Nov 2025 02:41:51 GMT, Connection=keep-alive, Strict-Transport-Security=max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains, Vary=Origin, X-Cs-Region=eu-1, X-Cs-Traceid=c186c49f-6850-499d-a0c4-658457c54106, X-Ratelimit-Limit=6000, X-Ratelimit-Remaining=5998
VERBOSE: 03:41:50 [Write-Result] query_time=0,000129772, powered_by=, trace_id=c186c49f6850499da0c4658457c54106

The Combined ID '1234_12345_123456' has been added to the policy 'TEST ENV - DEVICE CONTROL - VM-TEST'.

[bk-cs]

I have updated Copy-FalconDeviceControlPolicy to properly copy existing settings and exceptions. This change will be included in the next PSFalcon release. If you'd like to update your our local module before release, you can replace public\psf-policies.ps1 using the steps
outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/refs/heads/dev/public/psf-policies.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath public) psf-policies.ps1)

Please ensure that you close and re-open PowerShell and re-import PSFalcon before testing. I'll keep this issue open for others to apply this change until release.