Control USB Memory Drives Access

By Peter Johnstone ·
Win Server2k3 SP1 \ XP Pro SP2 clients on a Domain.

We require to prevent access to USB Memory Drives (Sticks etc) for certain groups of users but not for others on workstations (aprox 200)

I think it can be done through Group Policies, can anyone tell me how?



This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

I don't know if this is the answer that you need

by HAL 9000 Moderator In reply to Control USB Memory Drives ...

But it may help you along the way



Collapse -

Looks Good!

by Peter Johnstone In reply to I don't know if this is t ...

Thanks for your reply Hal, I think we can go with this one.

Thinking ahead?? I would like to be able to just prevent users from installing the drivers for such devices but allow admins to do so, this would mean only authorized devices could be used.

Any takers???.


Collapse -

Well the problem here is that

by HAL 9000 Moderator In reply to Looks Good!

Most of these devices don't actually need drivers for XP as they are built into XP so that in its self would be a major problem.

The only USB Devices that really need drivers are things like Scanners and printers all the USB Thumb Drives or HDD's are Plug & Play so you would have a problem there. Though if none has ever been fitted to a system maybe with restricted user rights it may be possible to stop the drivers installing, However it's something that I've never tried doing as basically I'm Lazy and always log on as Admin when I'm working on systems I've never tried plugging in one on a system with restricted rights so I'm not sure how things would go.

I've always used GP's to restrict users being able to use things like Thumb Drives and USB Drives and I've never had a position where the end user has needed to be able to use devices like this that where not given the rights to. Actually for that matter I'm not sure how things like Digital Cameras would go under a GP like the one above as technically it's possible to plug in a Digital Camera and copy data to the Memory Card to walk out with but it's something that I've never actually looked at because it's never been an issue previously.

When I worked Bank Security we locked down every terminal that was used and only allowed them the ability to do one job at the front counter and then others in the main processing area different jobs like to do International Transfers or make up Bank Drafts both International and National. So really it's something that I've never had the need to actually look at generally speaking every USB Port was disabled in BIOS with a Password on it to prevent the users enabling the ports as we didn't actually use them.

All I can suggest is that you try it and see what happens on a work station with restricted rights and see if it allows a Thumb Drive to install itself.

Sorry about that.


Collapse -

A pity...

by Peter Johnstone In reply to Well the problem here is ...

Thanks for your time on this one Hal.

It looks as if we may have to wait for Longhorn \ Vista which seems to have the answer to preventing installation of unauthorized device drivers.


Just a pity that it can't be applied to 2k3 \ XP Pro as well.

Unless someone out there knows different?......

Collapse -

Administrative Control over USB ports

by tom In reply to A pity...

If you haven't resolved this problem you may wish to look into USB Lock RP as an answer.

Collapse -

Not so fast ;-)

by IC-IT In reply to A pity...

This person seems to have written a nice little template to do the job.


Collapse -

How to Enable Power Users

by woody.funderburk In reply to Not so fast ;-)

I know how to disable users from using a usb thumb drive, but how do you enable them to use a USB thumb drive if they are not admins in XPSP2. I have played with the GPO about to allow interactive users for eject and format but I still receive user name password for admin. any ideas

Collapse -

You can use USB Drive Monitor Software

by Anasmaq In reply to Control USB Memory Drives ...

USB Drive Monitor Features:

Log Information about USB Mass Storage Devices inserted to your PC.

Drive Index
Logging Time
Drive Letter
Drive Label (Name)
Drive Size (GB)
Drive Unique Hardware Key
File Contents up to 3 Folder Levels Deep

Use your Personal USB Drive as an access key to your PC using the ?Access Key Mode?.

Alert for a Foreign USB Drive inserted to your PC using a custom text message or pick an alert sound file.

Delete Files of a Foreign USB Drive inserted to your PC Up to 3 Folder Levels Deep.

Manually Enable or Disable ( USB Mass Storage Devices )

Manually Enable or Disable ( Task Manager )

Related Discussions

Related Forums