Restricting file access on USB flash storage device.

[Joe]

We have been having problems with students running
programs such as games and keyboard sniffers off of USB
drives plugged into the ports on our computers. Without
stopping students from using USB drives for things such as
file transportation between home and school computers, is
there anyway to stop students from running .exe's off of
these? In other words, is it possible to only
restrict .exe's from being used off of these drives while
still allowing .doc's, .txt's, .bmp's,...etc, you know,
your non-harmful files? If so, please email
(e-mail address removed) for a solution.

Thank You

 

[Steven L Umbach]

You can control access to authorized only applications with Software
Restriction Policies in XP Pro, so if possible try to upgrade at least a few
machines to XP Pro to try that out.

It is much more difficult in W2K. You can try populating the disallowed
Windows applications list in Group Policy - local or domain in user
configuration/administrative tools/system and adding various .exe including
setup.exe and install.exe but I don't think it will work well in you
situation but easy enough to try. A more extreme solution may be to populate
the run only allowed Windows application list. If it is enabled, it will
allow a user to logon to a machine and not much else until specific
executables are added to the list. That is harder than it sounds though as
sometimes it is not always obvious what executeable is needed for thing like
Windows Update, though a free utility such as filemon from SysInternals will
usually show where the bottleneck is in the log via a denied access
essage. ---Steve