This USB Device Can Steal Information, Even if PC is Locked

Most of you probably already know about this. But i have some questions.

  1. if no user is actively logged in (just the login screen), can the device steal credentials?
  2. If group policy blocks the installation of USB devices, can this device steal credentials?

Thank you.

Removable devices are untrusted devices, so they can do no harm.