General discussion

Locked

Disable USB Drives

By rogerhale ·
I am looking for an effective way to disable USB drives without disabling other USB devices. Therefore, disabling USB in the BIOS is out. The office I'm working for uses a CADD program which requires a USB device to work. However, we are worried about what might be copied to a USB drive. I found some advice on this site about going into the Windows 2000 registry to disable the usbstor driver from loading. Here's the problem. It only disables it for 1 device. I inserted a Sandisk drive and then made the registry change. Then the Sandisk drive will not work. However, to test it, I then inserted a Lexar drive, and Windows went ahead and loaded the drivers and made it operational. I'm hoping someone has a better suggestion.

This conversation is currently closed to new comments.

9 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Using Group Policy

by chadsharp In reply to Disable USB Drives

When you say go into the registry.. are you talking about changing the value of the dword from 3 to 4 located in HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\USBSTOR\
Named "start". This worked for me but we are all on xp. you can also get third party software like DeviceLock that will do it.
Here is a link with some info on how to achive your goal through GP http://www.rokus.net/article75.google

I do not know if you are into scripting or not but that would be another alternitive. You could write a script that would watch for any change to the usbstor in the registry and use cdo to send a email to you or to multiple people. the user may be a little surprised when you show up one min after that insert the USB drive to ask them why that are doing that.
Chad

Collapse -

Yes, tried that.

by rogerhale In reply to Using Group Policy

Thanks for the help, Chad. Yes, I did change that dword as you described. I guess I may have to go with DeviceLock unless someone else has a better idea. It's strange. It seems like I ought to be able to disable the thing in the registry.

Collapse -

USB disable

by saurabh_dixit1234 In reply to Using Group Policy

hi Chand i read ur reply for disable the USB but it need to reboot computer. I want to make disable and again enable a particular USB port for my application can u tell me hows can i make it
for example i send signal to disable that USB port and again when i need make it enable without rebooting computer and other USB port are remains as it is , only changes with particular single USb port which i want to change. Is it possible ?? how ??

Collapse -

Easy

by Systadm In reply to USB disable

With products like USB Lock RP for you network or USB Lock AP for stand alone systems found at http://www.advansysperu.com/ you can achive exactly what you are looking for.

Collapse -

USB Lock RP

by jbucharderie In reply to Easy

Thanks, USB Lock RP is a different aproach to effective network end-point security. Its straightforward,light on resources, and easy to use. I would agree and say any system administrator looking to secure its network data should test this program.
Thanks

Collapse -

USB disable

by saurabh_dixit1234 In reply to Using Group Policy

hi mr. Chand i read ur reply for disable the USB but it need to reboot computer. I want to make disable and again enable a particular USB port for my application can u tell me hows can i make it
for example i send signal to disable that USB port and again when i need make it enable without rebooting computer and other USB port are remains as it is , only changes with particular single USb port which i want to change. Is it possible ?? how ??

Collapse -

USB disable and enable

by saurabh_dixit1234 In reply to Using Group Policy

hi mr. Chand i read ur reply for disable the USB but it need to reboot computer. I want to make disable and again enable a particular USB port for my application can u tell me hows can i make it
for example i send signal to disable that USB port and again when i need make it enable without rebooting computer and other USB port are remains as it is , only changes with particular single USb port which i want to change. Is it possible ?? how ??

Collapse -

Drivestopper software

by Info-Safety, LLC In reply to Disable USB Drives

This looks to be just what you are looking for. I found this on the web, but have not used it. If you decide to use this software, please post your results.

http://www.drivestopper.com/security/index.php

Good luck.

Craig Herberg
http://info-safety.com

Collapse -

Are you sure you are not over complicating the issue?

by averybaddog In reply to Disable USB Drives

As i understand the problem, you have sensitive information on your computer that you do not want removed, such as by USB Flash drive. However, there are others who use or have access to your computer?

Solution: Go to your user accounts, and password protect your acct as admin, remove other admin accts, set up guest account. Then, select the option to hide your personal files and folders, they will not be able to be accessed by a non admin user. Even if they connected a flash drive, they could not find your data to move it.
An even better solution, is disable all the guest accounts completely, and have only your own log in with user name and password. Be sure you also password protect the ADMINISTRATOR account, which is normally hidden, but can be accessed by, if i remember correctly, holding down the ctrl key on windows start. (not sure of the key exactly, and to lazy to look it up)
The method above, would allow fast user switching, with out having to actually log off, and would require a password to switch to the admin (your) profile. But it would keep 'people' from 'peephole'-ing..at your files. (yes, i can see your rolling your eyes)

Back to IT Employment Forum
9 total posts (Page 1 of 1)  

Related Discussions

Related Forums