Disable/Remove CDROM Drive

[patlav]

I work in a high security environment where the use of any type of CD
ROM is now prohibited. I'm looking for a was to disable the use of
the CDROM on all the Windows 2000 PC. Going around to all the PC and
changing the BIOS or physically removing the device is not practical.

IS there any 3rd party software to do this....I looked and looked and
it can't be done in Group Policy.

Any help is appreciated

 

[David H. Lipman]

From: <[email protected]>

| I work in a high security environment where the use of any type of CD
| ROM is now prohibited. I'm looking for a was to disable the use of
| the CDROM on all the Windows 2000 PC. Going around to all the PC and
| changing the BIOS or physically removing the device is not practical.
|
| IS there any 3rd party software to do this....I looked and looked and
| it can't be done in Group Policy.
|
| Any help is appreciated

Why would a read-only device be a security problem in the first place ?

Such a ruling would also mean disabling the serial ports, USB and FireWire ports as well.

If it was truly a security problem, then removing the drive *is* what is required.

In addition, what security regulation requires this ?


BTW: I was in a Top Secret "skiff" and all PCs had CDROMs and many had ZIP drives.

 

[James Blair]

I work in a high security environment where the use of any type of CD
ROM is now prohibited. I'm looking for a was to disable the use of
the CDROM on all the Windows 2000 PC. Going around to all the PC and
changing the BIOS or physically removing the device is not practical.

IS there any 3rd party software to do this....I looked and looked and
it can't be done in Group Policy.

Any help is appreciated

Actaully it can be done via GPO. Refer to this article:
http://support.microsoft.com/default.aspx?scid=kb;en-us;555324

Also, you could just disable the device in device manager (right click the
cd-rom, select disable). The user would need to have admin level rights to
re-enable it. Obviously, the GPO method would be easier for enterprise wide
deployment though.

Cheers.

Jim