Questions

Windows XP disabling USB

Tags:
+
0 Votes
Locked

Windows XP disabling USB

Fagan
Windows XP SP3 PCs connected to a linux server.
Need to be able to block access to the USB ports for memory sticks but still need to print if a USB printer is connected.

How to do this - Please ??

TerryF
  • +
    0 Votes

    SUMMARY
    This article discusses two methods that you can use to prevent users from connecting to a USB storage device.
    To Disable the Use of USB Storage Devices
    To disable the use of USB storage devices, use one or more of the following procedures, as appropriate to your situation:
    If a USB Storage Device Is Not Already Installed on the Computer
    If a USB storage device is not already installed on the computer, assign the user or the group Deny permissions to the following files:
    ?
    %SystemRoot%\Inf\Usbstor.pnf
    ?
    %SystemRoot%\Inf\Usbstor.inf
    When you do so, users cannot install a USB storage device on the computer. To assign a user or group Deny permissions to the Usbstor.pnf and Usbstor.inf files, follow these steps:
    1.
    Start Windows Explorer, and then locate the %SystemRoot%\Inf folder.
    2.
    Right-click the Usbstor.pnf file, and then click Properties.
    3.
    Click the Security tab.
    4.
    In the Group or user names list, click the user or group that you want to set Deny permissions for.
    5.
    In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
    Note In addition, add the System account to the Deny list.
    6.
    Right-click the Usbstor.inf file, and then click Properties.
    7.
    Click the Security tab.
    8.
    In the Group or user names list, click the user or group that you want to set Deny permissions for.
    9.
    In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
    If a USB Storage Device Is Already Installed on the Computer
    Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
    322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows
    If a USB storage device is already installed on the computer, set the Start value in the following registry key to 4:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
    When you do so, the USB storage device does not work when the user connects the device to the computer. To set the Start value, follow these steps:
    1.
    Click Start, and then click Run.
    2.
    In the Open box, type regedit, and then click OK.
    3.
    Locate, and then click the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
    4.
    In the right pane, double-click Start.
    5.
    In the Value data box, type 4, click Hexadecimal (if it is not already selected), and then click OK.
    6.
    Quit Registry Editor.
    http://support.microsoft.com/kb/823732

    Please post back if you have any more problems or questions.

    +
    0 Votes
    risques

    You have shown me a route to solve one of my most disturbing USB questions.

    Now to find out how the permissions for new devices got set as deny.

    Thanks for posting.

    Mike

    +
    0 Votes
    tomg1234

    Easy solution would be USB Lock ST from Advanced Systems. It's a tool that gives you control over how the USB port is used.

    +
    0 Votes
    Fagan

    Thank you for your replies.
    I will investigate both of these.
    Have also turned up a Pgm from http://www.y0ys.com/ (LockPc)that locks the USB ports but allows the printers to work independent of the lock.
    Many desktop setting can be also configured with this.

    +
    0 Votes
    Fagan

    Thank you for your replies.
    I will investigate both of these.
    Have also turned up a Pgm from http://www.y0ys.com/ (LockPc)that locks the USB ports but allows the printers to work independent of the lock.
    Many desktop setting can be also configured with this.

  • +
    0 Votes

    SUMMARY
    This article discusses two methods that you can use to prevent users from connecting to a USB storage device.
    To Disable the Use of USB Storage Devices
    To disable the use of USB storage devices, use one or more of the following procedures, as appropriate to your situation:
    If a USB Storage Device Is Not Already Installed on the Computer
    If a USB storage device is not already installed on the computer, assign the user or the group Deny permissions to the following files:
    ?
    %SystemRoot%\Inf\Usbstor.pnf
    ?
    %SystemRoot%\Inf\Usbstor.inf
    When you do so, users cannot install a USB storage device on the computer. To assign a user or group Deny permissions to the Usbstor.pnf and Usbstor.inf files, follow these steps:
    1.
    Start Windows Explorer, and then locate the %SystemRoot%\Inf folder.
    2.
    Right-click the Usbstor.pnf file, and then click Properties.
    3.
    Click the Security tab.
    4.
    In the Group or user names list, click the user or group that you want to set Deny permissions for.
    5.
    In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
    Note In addition, add the System account to the Deny list.
    6.
    Right-click the Usbstor.inf file, and then click Properties.
    7.
    Click the Security tab.
    8.
    In the Group or user names list, click the user or group that you want to set Deny permissions for.
    9.
    In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
    If a USB Storage Device Is Already Installed on the Computer
    Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
    322756 (http://support.microsoft.com/kb/322756/) How to back up and restore the registry in Windows
    If a USB storage device is already installed on the computer, set the Start value in the following registry key to 4:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
    When you do so, the USB storage device does not work when the user connects the device to the computer. To set the Start value, follow these steps:
    1.
    Click Start, and then click Run.
    2.
    In the Open box, type regedit, and then click OK.
    3.
    Locate, and then click the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
    4.
    In the right pane, double-click Start.
    5.
    In the Value data box, type 4, click Hexadecimal (if it is not already selected), and then click OK.
    6.
    Quit Registry Editor.
    http://support.microsoft.com/kb/823732

    Please post back if you have any more problems or questions.

    +
    0 Votes
    risques

    You have shown me a route to solve one of my most disturbing USB questions.

    Now to find out how the permissions for new devices got set as deny.

    Thanks for posting.

    Mike

    +
    0 Votes
    tomg1234

    Easy solution would be USB Lock ST from Advanced Systems. It's a tool that gives you control over how the USB port is used.

    +
    0 Votes
    Fagan

    Thank you for your replies.
    I will investigate both of these.
    Have also turned up a Pgm from http://www.y0ys.com/ (LockPc)that locks the USB ports but allows the printers to work independent of the lock.
    Many desktop setting can be also configured with this.

    +
    0 Votes
    Fagan

    Thank you for your replies.
    I will investigate both of these.
    Have also turned up a Pgm from http://www.y0ys.com/ (LockPc)that locks the USB ports but allows the printers to work independent of the lock.
    Many desktop setting can be also configured with this.