Hardware
Win Server2k3 SP1 \ XP Pro SP2 clients on a Domain.
We require to prevent access to USB Memory Drives (Sticks etc) for certain groups of users but not for others on workstations (aprox 200)
I think it can be done through Group Policies, can anyone tell me how?
Thanks,
PJ
by peter johnstone Accepted solution
by hal 9000 Accepted solution
But it may help you along the way
http://tinyurl.com/yg5zua
Col
by peter johnstone Accepted solution
Thanks for your reply Hal, I think we can go with this one.
Thinking ahead?? I would like to be able to just prevent users from installing the drivers for such devices but allow admins to do so, this would mean only authorized devices could be used.
Any takers???.
PJ
by hal 9000 Accepted solution
Most of these devices don't actually need drivers for XP as they are built into XP so that in its self would be a major problem.
The only USB Devices that really need drivers are things like Scanners and printers all the USB Thumb Drives or HDD's are [b]Plug & Play[/b] so you would have a problem there. Though if none has ever been fitted to a system maybe with restricted user rights it may be possible to stop the drivers installing, However it's something that I've never tried doing as basically I'm [b]Lazy[/b] and always log on as Admin when I'm working on systems I've never tried plugging in one on a system with restricted rights so I'm not sure how things would go.
I've always used GP's to restrict users being able to use things like Thumb Drives and USB Drives and I've never had a position where the end user has needed to be able to use devices like this that where not given the rights to. Actually for that matter I'm not sure how things like Digital Cameras would go under a GP like the one above as technically it's possible to plug in a Digital Camera and copy data to the Memory Card to walk out with but it's something that I've never actually looked at because it's never been an issue previously.
When I worked Bank Security we locked down every terminal that was used and only allowed them the ability to do one job at the front counter and then others in the main processing area different jobs like to do International Transfers or make up Bank Drafts both International and National. So really it's something that I've never had the need to actually look at generally speaking every USB Port was disabled in BIOS with a Password on it to prevent the users enabling the ports as we didn't actually use them.
All I can suggest is that you try it and see what happens on a work station with restricted rights and see if it allows a Thumb Drive to install itself.
Sorry about that.
Col
by peter johnstone Accepted solution
Thanks for your time on this one Hal.
It looks as if we may have to wait for Longhorn \ Vista which seems to have the answer to preventing installation of unauthorized device drivers.
(http://www.microsoft.com/technet/windowsvista/library/9fe5bf05-a4a9-44e2-a0c3-b4b4eaaa37f3.mspx)
Just a pity that it can't be applied to 2k3 \ XP Pro as well.
Unless someone out there knows different?......
by tom Accepted solution
by ic-it Accepted solution
This person seems to have written a nice little template to do the job.
http://www.pragmaticutopia.com/index2.php?option=com_content&do_pdf=1&id=89
by woody.funderburk Accepted solution
by anasmaq Accepted solution
USB Drive Monitor Features:
Log Information about USB Mass Storage Devices inserted to your PC.
Drive Index
Logging Time
Drive Letter
Drive Label (Name)
Drive Size (GB)
Drive Unique Hardware Key
File Contents up to 3 Folder Levels Deep
Use your Personal USB Drive as an access key to your PC using the ?Access Key Mode?.
Alert for a Foreign USB Drive inserted to your PC using a custom text message or pick an alert sound file.
Delete Files of a Foreign USB Drive inserted to your PC Up to 3 Folder Levels Deep.
Manually Enable or Disable ( USB Mass Storage Devices )
Manually Enable or Disable ( Task Manager )
This discussion is closed to new replies.
Sort by Trending