Solved

How to Deny access to all Removable Media for select users on SBS 2011

Posted on 2014-02-10
6
705 Views
Last Modified: 2014-02-12
I have created a GPO on my SBS 2011 box to deny all access to removable media for a specific group I created. Policy is enabled/enforced and linked appropriately.

However despite all efforts, the policy does not apply to the users in the group.

I have applied the policy to both the computer and user configuration in the GP.

When I run RSOP on a user, I can see the policy is enabled under the user configuration, however, will never show up under the computer configuration despite not being configured in any other GPO.

Is this not supposed to work by design or is there some other way to get this GPO to function.
0
Comment
Question by:tjwo94
  • 3
  • 2
6 Comments
 
LVL 18

Expert Comment

by:Netflo
Comment Utility
The GPO needs to be tweaked slightly differently if applying to Windows XP clients as opposed to Windows 7 and above which will just work. Is this the case?

If so, please take a look at the following link: http://www.grouppolicy.biz/2010/02/how-to-use-group-policy-to-disable-usb-drives-on-windows-xp/
0
 

Author Comment

by:tjwo94
Comment Utility
All clients are Windows 7, hence the frustration as to why it isn't working.
0
 
LVL 74

Accepted Solution

by:
Jeffrey Kane - TechSoEasy earned 500 total points
Comment Utility
This is not a USER policy, so do not set anything in the user configuration.

There are THREE settings which must be enabled in your GPO under Computer Configuration > Policies > Administrative Templates > System > Removable Storage Access:


Removable Disks: Deny execute access Enabled
Removable Disks: Deny read access Enabled
Removable Disks: Deny write access Enabled

Deny USB Drives
Make sure that this policy is linked either at the domain level, or if to an OU, that all machines that are restricted are in the OU.

If the above doesn't work, please run the following command on a workstation:

C:\>gpresult /h gp.html

Then post the resulting "gp.html" file back here.
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 

Author Comment

by:tjwo94
Comment Utility
Just to clarify, this policy can only be applied to specific machines, not specific users? So I would need to put specific machines in an OU as opposed to specific users?
0
 
LVL 74

Expert Comment

by:Jeffrey Kane - TechSoEasy
Comment Utility
Yes, it is a MACHINE setting, not a USER setting.

FYI, if you don't want to move the machines to a specific OU, you could always just create a SECURITY GROUP and add them to that, and then delegate the GP to only that Security Group.

Jeff
0
 

Author Closing Comment

by:tjwo94
Comment Utility
Thank you Jeff for the help and clarification, I'll have no trouble getting the access squared away now.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Introduction At 19:33 (UST) on Tuesday 21st September the long awaited email arrived with the subject title of “ANNOUNCING THE AVAILABILITY OF WINDOWS SBS 7 PREVIEW”.  It was time to drop whatever I was doing and dedicate as much bandwidth as possi…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now