How Do I Disable USB Storage Devices for one Group and Enable it for another?

[d_mc_alister]

Hi there

I am an IT Technician for a Medium Company with upwards of 1000 PC's
operating in a Win2k Domain. I have been asked to Set up a USB Policy
whereby normal users are prevented from using USB devices on their PC's
and also other selected users are permitted to install the devices in
their PC's.

I was hoping to do this by membership of certain Security Groups in our
Active Directory where for example if you are a member of a Group
called "USBAccess" you can use the device. If you are not a member of
this group you would be denied access to USB Drives.

I would also like to deny certain users access to the Registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR so that
users would not be able to change any values.

Also this policy would not affect USB Keyboards and Mice.

Hopefully someone can help

 

[Steven L Umbach]

The info in the first KB link below may help though I have not tried it
myself so I can not advise you further on trick and traps otherwise look
into third party solutions which may be well worth the money such as
Devicelock or Reflex Disknet at the other links below. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;823732
http://www.reflex-magnetics.com/products/disknetpro/
http://www.protect-me.com/dl/