• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 322
  • Last Modified:

USB - Registry

Hi all

We need to disable the USB in the bios Level. As all are aware that we do get desktops on usb keyboard and mouse and so we have disabled the registry

hklm\system\currentcontrolset\services\usbstor. by changing the start value to 4 usb is by default getting disbaled.

the users are the admin accounts to the local systems. Is there any way we can set permission to the registry value where in users will not be allowed to change the access.

NOTE: I have even tried the following things. I went to the key and selected permissions and removed everyone and selected only domain admins over there and has pushed the same through group policy also. But users are able togo the keys and select add and add everyone and give full permissions and change the value. Is there a way to stop this.

my main aim is Either user should be allowed to change the value in the registry even if they are local admins.

I have tried even disbaling registry. some softwares gets installed and some does not as it gets written to the HKLM. So kindly help me in this.

1 Solution

You can disable registry editing via group policy.  Another option is to lock down this area of the registry.  I would honestly recomend you not let anyone except for administrators even edit the registry.  Your users should be a member of hte users group not Power Users or Administrators.  If they are a member of local power users or administrators, they can chagne permissions.

I highly recomend you use the group policy editor to lock down the workstations, so the users cannot change anything at all in the registry.  I am also confused how users would even know that hklm\system\currentcontrolset\services\usbstor even controlls the usb storage service.  If they know that much, you probably will have problems no matter what you do.  Another option might be to just delete the usbstor service entirely.

Fire up the command prompt and type c:\>sc delete usbstor.  They cannot turn it on if it doesn't exist.  Then I serriously doubt they would be able to manually create the necessariy entries with regedit.

You had better make a backup of that registry key though, else you will have to snag it from another computer.

Thanks and BTW, why don't you want USB Hard DRives and MemorySticks to function?

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: CompTIA Cloud+

The CompTIA Cloud+ Basic training course will teach you about cloud concepts and models, data storage, networking, and network infrastructure.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now