?
Solved

USB -  Registry

Posted on 2006-05-28
3
Medium Priority
?
320 Views
Last Modified: 2013-12-04
Hi all

We need to disable the USB in the bios Level. As all are aware that we do get desktops on usb keyboard and mouse and so we have disabled the registry

hklm\system\currentcontrolset\services\usbstor. by changing the start value to 4 usb is by default getting disbaled.

the users are the admin accounts to the local systems. Is there any way we can set permission to the registry value where in users will not be allowed to change the access.

NOTE: I have even tried the following things. I went to the key and selected permissions and removed everyone and selected only domain admins over there and has pushed the same through group policy also. But users are able togo the keys and select add and add everyone and give full permissions and change the value. Is there a way to stop this.

my main aim is Either user should be allowed to change the value in the registry even if they are local admins.

I have tried even disbaling registry. some softwares gets installed and some does not as it gets written to the HKLM. So kindly help me in this.


0
Comment
Question by:ranga_matta
1 Comment
 
LVL 3

Accepted Solution

by:
Jbirk1 earned 1000 total points
ID: 16787166
Hi,

You can disable registry editing via group policy.  Another option is to lock down this area of the registry.  I would honestly recomend you not let anyone except for administrators even edit the registry.  Your users should be a member of hte users group not Power Users or Administrators.  If they are a member of local power users or administrators, they can chagne permissions.

I highly recomend you use the group policy editor to lock down the workstations, so the users cannot change anything at all in the registry.  I am also confused how users would even know that hklm\system\currentcontrolset\services\usbstor even controlls the usb storage service.  If they know that much, you probably will have problems no matter what you do.  Another option might be to just delete the usbstor service entirely.

Fire up the command prompt and type c:\>sc delete usbstor.  They cannot turn it on if it doesn't exist.  Then I serriously doubt they would be able to manually create the necessariy entries with regedit.

You had better make a backup of that registry key though, else you will have to snag it from another computer.



Thanks and BTW, why don't you want USB Hard DRives and MemorySticks to function?

Justin
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As I write this article, I am finishing cleanup from the Qakbot virus variant found in the wild on April 18, 2011.  It was a messy beast that had varying levels of infection, speculated as being dependent on how long it resided on the infected syste…
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
SQL Database Recovery Software repairs the MDF & NDF Files, corrupted due to hardware related issues or software related errors. Provides preview of recovered database objects and allows saving in either MSSQL, CSV, HTML or XLS format. Ensures recov…
This video tutorial shows you the steps to go through to set up what I believe to be the best email app on the android platform to read Exchange mail.  Get the app on your phone: The first step is to make sure you have the Samsung Email app on your …
Suggested Courses
Course of the Month8 days, 13 hours left to enroll

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question