[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Disabling USB Storage by Group Policy

Posted on 2011-03-06
5
Medium Priority
?
1,768 Views
Last Modified: 2012-06-27
Points of My Scenario:
1. I am admin of a Windows Server 2003 domain
2. Workstations have Windows XP Pro, SP3
3. I have implemented a group policy to prevent the use of USB storage as per Microsoft KB555324 (http://support.microsoft.com/default.aspx?scid=kb;en-us;555324)
4. It works ONLY if the workstation has been exposed to a USB flash drive and "gpupdate /force" command is executed.
MY CHALLENGE: Although the policy works, it only works to block the same flash drive used to expose the workstation to USB storage (see point #4): other flash drives still have access.
QUESTION: What can I do to ensure the policy blocks all USB storage media?
0
Comment
Question by:waforbes100
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 29

Expert Comment

by:Dr. Klahn
ID: 35051053
A very similar question was asked here September 2008.  The responses seem to parallel what you have already done.

Server has a GPO that does what you want, although I don't know if these policies are available in XP.  Certainly disabling all removable media would do the job, but this would also disable floppy disks, ZIP drives and CD/DVDs.

An alternate possibility is a hardware approach.  Disconnect the front panel USB connector(s) from the motherboard.

0
 

Author Comment

by:waforbes100
ID: 35056456
To DrKlahn: I need to retain USB input capability (e.g. mouse, keyboard). Additionally, I have disabled all media that the policy allows, but the problem persists.
0
 
LVL 29

Assisted Solution

by:Dr. Klahn
Dr. Klahn earned 600 total points
ID: 35063503
Presumably the USB mouse and keyboard are attached through the back panel.  That is why I suggested disconnecting only the front panel USB connectors.
0
 
LVL 1

Accepted Solution

by:
dhanraj114 earned 1400 total points
ID: 35066314
I have tried the given KB on my Server 2003 and Windows XP Pro network. But it sometimes blocks and sometimes releases the USBs. More blocking from GP also blocks keyboard, mouse, printer and scanner also. I was not succeeded in this. Finally i have adopted a third party software named DeviceLock, which is the perfect software for a network. It allows user based permissions, and users are fetched from Domain. It works fine with me. I suggest you for any third party software.
0
 

Author Closing Comment

by:waforbes100
ID: 35082503
My solution was to configure GPO to deny access to the USBSTOR.SYS file. In 100% of test workstations it worked!
0

Featured Post

[Video] Create a Disruption-Free Workspace

Open offices have their challenges. And Sometimes, it's even hard to work at work. It's time to reclaim your office and create a disruption-free workspace. With the MB 660, you can:

-Increase Concentration
-Improve well-being
-Boost Productivity

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A hard and fast method for reducing Active Directory Administrators members.
Let's recap what we learned from yesterday's Skyport Systems webinar.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question