Advice on restricting local removable media access?

[FM]

I'd be interested in advice on how to lock out removable media on
Windows XP Pro, on a per-user basis.

This is for a shared home machine, not in a domain; I'm not researching
a corporate solution here (although since I am interested in knowledge
in general, comments on such would be fine).

I'm most interested in how to lock out USB flash disks, since these are
ubiquitous.

Second in importance would be how to lock out the CD writer without
disabling its read capability, although the people I share my computer
with are unlikely to be carrying around writable CDs.

Thirdly would be advice about the floppy drive. I am willing to disable
the drive entirely, of course, but would still like to learn if there
*are* per-user solutions to this.

Thanks!

--FM /)`

 

[Malke]

I'd be interested in advice on how to lock out removable media on
Windows XP Pro, on a per-user basis.

This is for a shared home machine, not in a domain; I'm not researching
a corporate solution here (although since I am interested in knowledge
in general, comments on such would be fine).

I'm most interested in how to lock out USB flash disks, since these are
ubiquitous.

Second in importance would be how to lock out the CD writer without
disabling its read capability, although the people I share my computer
with are unlikely to be carrying around writable CDs.

Thirdly would be advice about the floppy drive. I am willing to disable
the drive entirely, of course, but would still like to learn if there
*are* per-user solutions to this.

There are no "per user" solutions. When you apply a restriction using Group
Policy on a Workgroup (non-domain) computer, it applies to all users on the
computer. Since this is a home computer, surely *speaking* to the people
involved should work?

Malke

 

[FM]

There are no "per user" solutions. When you apply a restriction using Group
Policy on a Workgroup (non-domain) computer, it applies to all users on the
computer. Since this is a home computer, surely *speaking* to the people
involved should work?

Malke

OK, sorry to say I haven't found *any* policy that works, so I presume
you still know more than I. If we set aside the "per user" aspect,
please tell me what policy(s) you might suggest.

Regarding the non-technical approach you propose: certainly true. But
my goal here is as much to learn the technical side of this, as to
"solve the problem".

And regarding that last: feel free to point me at good documentation!
But I'll have to say that, so far, Google has not been my friend.

Thanks!

--FM /)`

 

[Malke]

OK, sorry to say I haven't found *any* policy that works, so I presume
you still know more than I. If we set aside the "per user" aspect,
please tell me what policy(s) you might suggest.

Regarding the non-technical approach you propose: certainly true. But
my goal here is as much to learn the technical side of this, as to
"solve the problem".

And regarding that last: feel free to point me at good documentation!
But I'll have to say that, so far, Google has not been my friend.

There are a lot of Group Policies to restrict what users can do. Run
gpedit.msc and look at the Administrative Templates. Questions about Group
Policy can be asked in its newsgroup:

microsoft.public.windows.group_policy

You can also start reading articles about Group Policy:

http://www.google.com/#hl=en&q=Group+Policy+xp&aq=f&aqi=g10&oq=&fp=2cca7b2e99206b9c

Be *very* careful when using Group Policy; it is not impossible to lock
yourself out.

Malke