Disable usb/floopy and cd rom usage via bios

Hi,

I had the same issue for a company I used to work for. Below is the actual Document I wrote for the PC techs. It has snippets directly from Microsofts website for disabling Mass Storage devices. I hope this helps.

Procedures for disabling Mass Storage Devices:

Below is the 1st step in disabling the ability to connect a Mass Storage device via the USB interface. Even if a user connects a device, it will not recognize. We have checked that this is true with Thumb Drives, USB Floppy Drives and USB CD-Rs. We have not checked this with a PDA device as we do not have one, but I am confident that the same result will occur.

Also we have disabled the Serial and Parallel ports in the BIOS of the PC. The BIOS will be protected with a strong password that will only be known by a very select few individuals.

If a USB Storage Device Is Not Already Installed on the Computer
If a USB storage device is not already installed on the computer, assign the user or the group Deny permissions to the following files:
•      %SystemRoot%\Inf\Usbstor.pnf
•      %SystemRoot%\Inf\Usbstor.inf
When you do so, users cannot install a USB storage device on the computer. To assign a user or group Deny permissions to the Usbstor.pnf and Usbstor.inf files, follow these steps:
1.      Start Windows Explorer, and then locate the %SystemRoot%\Inf folder.
2.      Right-click the Usbstor.pnf file, and then click Properties.
3.      Click the Security tab.
4.      In the Group or user names list, click the user or group that you want to set Deny permissions for.
5.      In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
6.      Right-click the Usbstor.inf file, and then click Properties.
7.      Click the Security tab.
8.      In the Group or user names list, click the user or group that you want to set Deny permissions for.
9.      In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.



If a USB Storage Device Is Already Installed on the Computer
If a USB storage device is already installed on the computer, set the Start value in the following registry key to 4:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
When you do so, the USB storage device does not work when the user connects the device to the computer. To set the Start value, follow these steps:
1.      Click Start, and then click Run.
2.      In the Open box, type regedit, and then click OK.
3.      Locate, and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
4.      In the right pane, double-click Start.
5.      In the Value data box, type 4, click Hexadecimal (if it is not already selected), and then click OK.
6.      Quit Registry Editor.

The next step is to disable the PnP Services in the registry using the following steps:

Disable Universal Plug and Play Device Host
Open your registry and find the key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost]. Set the value of "Start" to "4" to disable the service, or "3" to enable it.
Disable UnPnP Discovery Service
Open your registry and find the key [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV]. Set the value of "Start" to "4" to disable the service, or "3" to enable it.
Restart Windows for the change to take effect.


~Daed