USB flash card readers/USB pen drives/hard drives

[Joe P]

Those USB flash drives are becoming very common. Is there
a registry entry that can prevent the USB Mass Storage
Driver from loading so that USB flash drives or memory
readers will not mount?

Using lastdrive=D is not an option since I can't change
network drive letters. Also, disabling USB altogether is
not an option since USB mice need to continue working.

Automounting USB memory is a physical security risk. Can
XP Home and Win2K lock them out?

Thanks,

Joe P

 

[Pavel A.]

Those USB flash drives are becoming very common. Is there
a registry entry that can prevent the USB Mass Storage
Driver from loading so that USB flash drives or memory
readers will not mount?

Yes, you can disable USB Mass Storage driver - though not quite thru a
"registry entry".

Automounting USB memory is a physical security risk.

Why do you think so? how are USB drives different from floppy, CD writer or
other removable media?

- PA

 

[Joe P]

Yes, you can disable USB Mass Storage driver - though not quite thru a
"registry entry".

So is there a quick and easy way to do this? For example
through a batch file (yes I know, no one likes them), or
script, or registry entry?

Why do you think so? how are USB drives different from floppy, CD writer or
other removable media?

I didn't say they are the only physical security risk.
Yes, so are other removeable media. But some new
computers don't come with floppy drives, they don't hold
much, and there are many ways to disable them. CD's are
bigger and more easily noticed and there are many well
documented ways to disable them.

Where is the documentation on ways to prevent USB flash
devices from mounting?

Thanks,

Joe

 

[Pavel A.]

So is there a quick and easy way to do this? For example
through a batch file (yes I know, no one likes them), or
script, or registry entry?

IMHO the the simple (= fast and dirty) way is to delete INF files of in-box
USB flash devices.
This will prevent non-admin users from installing in-box drivers.
The next step can be disabling the USB storage driver's service, so no
devices of this class will work.

The most authoritative answer you can get in
microsoft.public.development.device.drivers
or in microsoft.public.windows.file_system newsgroups.

Regards,
--PA