[Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 932
  • Last Modified:

restrict usb ports for storage devices

hi

i want to restrict users from accessing usb storage devices from there systems.  we have windows server 2003 domain and windows 2000, xp, vista clients. i got the links how to restrict in workstation as well as in domain through group policies. i am able to do in workstation but i am unable to do it in domain level.

the links are:

http://www.petri.co.il/disable_usb_disks_with_gpo.htm

http://www.petri.co.il/forums/showthread.php?t=3299

please help me.
0
ramachandraraju
Asked:
ramachandraraju
  • 3
  • 2
  • 2
  • +1
2 Solutions
 
ashutoshsapreCommented:
Instead of doing it using GPEDIT.MSC, if you have GPMC console install use that to create a new group policy at domain level and edit it. Add the ADM template given on the PERTI's website.

Download the USB_removable_drives_ADM file

Follow the same steps as you did while using the Gpedit.msc console.
0
 
nipponsoulCommented:
I would create a new Group Policy at domain level as well and avoid using the existing one as well. You have a better view of your organization's policies that way and it is best practice to avoid putting everything under default policy.

0
 
rwgatbhcCommented:
If you're trying to restrict the use of the USB drive entirely, then why not just disable it in the BIOS of the workstation, setup a password for system changes prior to deployment to the end user and then just be done with it.
0
Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

 
ramachandrarajuAuthor Commented:
if i disable in BIOS i cant use usb keyboard, mouse and any other USB input devices.

i did all the things as in pretri link. but its not working in domain level.

please help me.
0
 
nipponsoulCommented:
Always have a test OU with test computer and user in place in your AD and ALWAYS test new policies before pushing them to live environment.

Can you please create a test OU, apply the policy there and try ?

Did you use gpupdate/force? computers need to restart to take new policies if the command is not run.
Have you waited for DC replication?
Policies take some time to apply.

Run gpupdate/force amd then gpresult  to view which policies are applied on a client where the policy was applied.
0
 
ramachandrarajuAuthor Commented:
i created test OU and computer and user.
i applied group policy settings and i used gpupdate /force
i have only one DC.

when i am checking for gpresult its not showing the group policy i applied to the OU.

i did the below way:
OU --- properties --- group policy ---- edit --- changed the settings and closed all the windows
gpupdate /forece i used and i tried with the user who's the member of that OU. but its not working. i restarted the client. i logged into the machine before restart and after restart also but no result.


i didnt see the policy name in the list when i used guresult.


0
 
nipponsoulCommented:
Can you test if it is ok in  GPMC? To check if a policy has been applied to a user or computer is to use the gp management console to create a rsop (resultant set of policy) report using the GP Results Wizard for the specific user or computer.

Here is a nice guide to test policies with gpmc and rsop :)

http://windows-secure.net/Addison.Wesley-Windows.Server/0321305019/ch09lev1sec1.html

Let us know who it goes  ^^ and if u get errors.
0
 
ashutoshsapreCommented:
Implementing this Group policy to disable the USB requires 2 restarts.
One restart applies the policy and sets the startup type of USBSTOR service to disabled, the service is still started as the policy is applies after the services are started. After the next restart the service does not start and thus the USB storage does not work.
0
 
rwgatbhcCommented:
What is the make/model (brand name) of the workstation, or do you have multiple different systems?
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now