Solved

USB, CD-ROM, Floppy Disk and LS-120 drivers Blocking from Group Policy not working

Posted on 2008-10-30
5
929 Views
Last Modified: 2013-12-04
Hi All,
I was instructed by my client to disable USB flash drives, USB HDD, floppy drives, SD... to some users in company.

I have followed Microsoft and Petri instruction to the letter but unfortunately its not working!

http://support.microsoft.com/kb/555324

http://www.petri.co.il/disable_usb_disks_with_gpo.htm

I have rebooted the computers, applied the policy to one user or a group didnt make different.

I dont want to install Endpoint protection or any third party software I would like to get it done using Microsoft software only please :)

Check attachments

OS: Windows Server 2003 R2 64bit SP2 with 4GB RAM

Sean
Group-Policy-List.JPG
USB-Disable-USB.JPG
Group-Policy-Link-with-AD.JPG
0
Comment
Question by:prodriveit
  • 2
  • 2
5 Comments
 
LVL 31

Accepted Solution

by:
Toni Uranjek earned 250 total points
ID: 22839142
Hi!

You can't link GPO to users or groups, link your GPO to OU which contains computer accounts, because you are trying to configure Computer Configuration part of GPO.

HTH

Toni
0
 
LVL 2

Author Comment

by:prodriveit
ID: 22839574
Thank you Toni for putting me in right direction

But is there any way I could apply the policy to the user instead of the computer because users move around all the time?

It just makes life bit easer

Sean
0
 
LVL 31

Expert Comment

by:Toni Uranjek
ID: 22839633
No, unfortunately "Computer Configuration" settings can be applied only to computer accounts. There is loopback mode which will process computer configuration after user logs on, but this will not help in your case because your users switch computers.

0
 
LVL 2

Author Comment

by:prodriveit
ID: 22839719
I guess I need to install Endpoint MR3 to work around this issue which will take around 5-7 hrs to install and configure fully with all the clients.

Thank you Toni

Sean

0
 
LVL 1

Assisted Solution

by:tomtown
tomtown earned 250 total points
ID: 22840172
Can you try it using the registry directly?
Set the folowing value to 4
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Start=dword:00000004
do a
net stop usbstor
net start usbstor
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Suggested Solutions

This is a guide to the following problem (not exclusive but here) on Windows: Users need our support and we supporters often use global administrative accounts to do this. Using these accounts safely is a real challenge. Any admin who takes se…
Users of Windows 10 Professional can disable automatic reboots using the policy editor. This tool is not included in the Windows home edition. But don't worry! Follow the instructions below to install (a Win7) policy editor on your Windows 10 Home e…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now