gpo

Hi I am using a windows 2003 domain, I have a about 100 computers on my domain. I want to prevent my users from using USB removable disks on their computers. I want this to be done using Group Policy, but I am not too sure how to go about doing this? Help please. Thanks.
gmollineauAsked:
Who is Participating?
 
Lee_YCPCommented:
what skill level are you working with?  i.e. Have you ever created a GPO before?
0
 
gmollineauAuthor Commented:
Hi, No. But i have an idea from the reading I did.
0
Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

 
Lee_YCPConnect With a Mentor Commented:
Meko72 pretty much hit it on the head with his two links.

An alternative to using the ADM file would be to use a GPO to change a registry entry at HKLM\System\CurrentControlSet\Services\USBSTOR\"Start"=dword:00000003  or  4

see
http://support.microsoft.com/kb/823732 

Does this answer your question?
0
 
gmollineauAuthor Commented:
Meko 72:  I used the microsoft article above and created the .adm file. I copied the .adm file  to the path c:\winnt\inf on the server running the group policy management. What do I do next I am unsure. I created an OU with a few computers in it, these are the computers I want to control in terms of blocking the usb.

0
 
gmollineauAuthor Commented:
When I add the template, I am not seeing the settings, it is showing blank.I keep getting event ids 1030, 1058 on my server.
0
 
gmollineauAuthor Commented:
Ok i eventually got rid of the event ids, and I am now seeing the settings. I configured the disable usb setting as enabled, and the disable usb ports as disabled. I then linked and enforced this gpo to an OU. When I tested it on a computer I can still see my usb drive. Any suggestions?
0
 
meko72Commented:
Can you access the USB device?
0
 
gmollineauAuthor Commented:
yes i can, I can copy a document to it.
0
 
meko72Commented:
Have you ran gpupdate/force from the command line on the server?
0
 
gmollineauAuthor Commented:
yes I did.  I ran it on both the server and the few computers I am testing.
0
 
gmollineauAuthor Commented:
Lee Ycp: The article you posted above, can I put this registry change in a script or any other format in a gpo and link it to an OU?
0
 
Lee_YCPCommented:
You can create the registry change directly in the GPO.
Open GPMC.
Create a new GPO.
Edit it. (right-click/Edit)
Navigate to Computer Configuration/Preferences/Windows Settings/Registry.
Right click in the right column and select "New/Registry Item"
Navigate to HKLM\System\CurrentControlSet\Services\USBSTOR\Start
Change the Value Data from "00000003" to "00000004" and click "OK".
CLose the GPME.
In the GPMC, link the GPO to your test OU.
Reboot or Run a force update on the test client.
0
All Courses

From novice to tech pro — start learning today.