Restricting Desktop Computers to view USB Flash Drive

[M P]

Hi!

I have problem with this USB flash drive. Since Windows 2000/XP allow this
to install on ordinary users which is we need to restrict. Can this be
disabled on Group Policy?

Me

 

[Mark Heitbrink [MVP]]

Hi,

I have problem with this USB flash drive. Since Windows 2000/XP allow this
to install on ordinary users which is we need to restrict. Can this be
disabled on Group Policy?

Not in a secure way.
- "nodrives" and "noviewondrives" have the problem that you need to
know the driveletter ... can be totally different on the clients.
- Disabling the Driver in CCS has the problem, that you have to
start it manually, if you login as an administrator
IMHO the best way is using 3rd Party.

Disbaling the driver via ADM:
----------- cut usb.adm -----------
CLASS MACHINE

CATEGORY "Services and Driver"
POLICY "USB-MassStorageDriver"
KEYNAME "System\CurrentControlSet\Services\usbstor"
PART "Startup" DROPDOWNLIST
VALUENAME "Start"
ITEMLIST
NAME "Boot" VALUE NUMERIC 0
NAME "System" VALUE NUMERIC 1
NAME "Automatic" VALUE NUMERIC 2 DEFAULT
NAME "Manual" VALUE NUMERIC 3
NAME "Deaktivated" VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
END CATEGORY

----------- cut usb.adm -----------

Some 3rd Party
Drive Lock, Centertools http://www.centertools.de/

DeviceLock, SmartLine http://www.protect-me.com/de/dl/

Sanctuary Device Control (formaly SecureNT) SecureWave
http://www.securewave.com/

A little more, than you want:
PolicyMaker, DesktopStandard
http://www.desktopstandard.com/PolicyMakerStandard.aspx

Mark

 

[Andrew]

Hi!

I have problem with this USB flash drive. Since Windows 2000/XP allow this
to install on ordinary users which is we need to restrict. Can this be
disabled on Group Policy?

Me

Check out DeviceLock (www.devicelock.com). Using DeviceLock you can
white list
USB devices. DeviceLock can't be disabled even by local admins.
DeviceLock can be managed from the Windows Group Policy Editor because
it fully supports Group Policy.