You can do it by denying the System account permissions on usbstor.inf
and usbstor.pnf when she logs on. When you log on you reverse the
restrictions and allow the System account permissions on the files. You
can use the CACLS command in a batch file to accomplish this. At this
time my plan is only "half baked" ;-) and I don't have a USB drive to
test this on so you will have to do some tinkering, but it would go
something like this:
To deny:
cacls %systemroot%\inf\usbstor.inf /e /p system:n
cacls %systemroot%\inf\usbstor.pnf /e /p system:n
To allow:
cacls %systemroot%\inf\usbstor.inf /e /p system:f
cacls %systemroot%\inf\usbstor.pnf /e /p system:f
You can make a little batch files with these two little command lines
and then have a logon script process the batch file for each respective
users and the desired permissions will be applied when the users log on.
As I said, "the plan is only half baked" so you may have to adjust the
oven temperature. If the cake flops we may have to adjust the recipe
and add more baking powder. Let us know how you make out with it and if
it works.
Oh, I almost forgot, to check permissions use the cacls command as follows:
cacls %systemroot%\inf\usbstor.inf
change the file name accordingly when verifying the file permissions.
Permissions enabled it will look like this (note the NT AUTHORITY\SYSTEM
permissions :F ):
C:\>cacls %systemroot%\inf\usbstor.inf
C:\WINDOWS\inf\usbstor.inf BUILTIN\Users:R
BUILTIN\Power Users:R
BUILTIN\Administrators:F
NT AUTHORITY\SYSTEM:F
C:\>cacls %systemroot%\inf\usbstor.pnf
C:\WINDOWS\inf\usbstor.PNF NT AUTHORITY\SYSTEM:F
BUILTIN\Users:R
BUILTIN\Power Users:C
BUILTIN\Administrators:F
Permissions denied it will look like this (note the NT AUTHORITY\SYSTEM
permissions :N):
C:\>cacls %systemroot%\inf\usbstor.inf
C:\WINDOWS\inf\usbstor.inf NT AUTHORITY\SYSTEM:N
BUILTIN\Users:R
BUILTIN\Power Users:R
BUILTIN\Administrators:F
C:\>cacls %systemroot%\inf\usbstor.pnf
C:\WINDOWS\inf\usbstor.PNF NT AUTHORITY\SYSTEM:N
BUILTIN\Users:R
BUILTIN\Power Users:C
BUILTIN\Administrators:F
See here for more information on CACLS:
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/cacls.mspx?mfr=true
Once again, let me know if it works.
John
