Stopping the use of USB drives

Soldato
Joined
2 Dec 2002
Posts
6,581
Location
N.Ireland
I do in our place, can be done via GP, I import a .reg file that disables the usb Store so any usb devices inserted are not detected...

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR]
"Start"=dword:00000004
 
Last edited:
Associate
Joined
10 May 2004
Posts
188
Location
Derby, UK
If you are running a Domain Controller and have your computers joined to it.

There are options using GPO to allow or deny USB access depending on the user or group.

I work in a school - and we have it set so staff can access usb but students cannot. :D
 

RSR

RSR

Soldato
Joined
17 Aug 2006
Posts
9,519
We block USB sticks, they can be blocked via GPOs as above. However, we block ours via our AV.

Andy
 

Ev0

Ev0

Soldato
Joined
18 Oct 2002
Posts
14,152
We use a paid up product that allows monitoring and control of USB devices, but as said it costs :)
 
Caporegime
Joined
25 Jul 2003
Posts
40,098
Location
FR+UK
If you are running a Domain Controller and have your computers joined to it.

There are options using GPO to allow or deny USB access depending on the user or group.

I work in a school - and we have it set so staff can access usb but students cannot. :D
Hmm interesting. Is there anyway to disable usb storage devices, but allow mobile devices to connect via activesync?
 
Associate
Joined
10 May 2004
Posts
188
Location
Derby, UK
I would guess if the mobile devices can sync without mapping a drive then yes they should work ok.

It doesnt stop any USB working - it just makes it so when a usb storage device is plugged in you cant see the drive it creates :D
 
Soldato
Joined
4 Dec 2002
Posts
3,940
Location
Bourne, Lincs
I wish I could find a product that works in Citrix/TS environments properly :(

You can. We use GPO on all our machines. We basically remove drive letters. We basically allow C: and the network drives, nothing else.

Then we have policies to allow use of the cd drive in laptops for instance

Kimbie
 
Associate
Joined
6 Apr 2003
Posts
679
Location
Halfway
We use a paid up product that allows monitoring and control of USB devices, but as said it costs :)

As do we. We use a product called Sanctuary which can stop anything being used. For all I moan about it every time someone needs to read a CD, it's great for keeping control of the PC's.
No-one can add anything without us knowing about it, and when you do allow USB or CD access, it can shadow copy, so we can see exactly what has been put on or copied off the network.
 

Ev0

Ev0

Soldato
Joined
18 Oct 2002
Posts
14,152
As do we. We use a product called Sanctuary which can stop anything being used. For all I moan about it every time someone needs to read a CD, it's great for keeping control of the PC's.
No-one can add anything without us knowing about it, and when you do allow USB or CD access, it can shadow copy, so we can see exactly what has been put on or copied off the network.

I think most people with a paid up product use this tbh :)
 
Soldato
Joined
26 Feb 2009
Posts
14,814
Location
Exeter
You can. We use GPO on all our machines. We basically remove drive letters. We basically allow C: and the network drives, nothing else.

Then we have policies to allow use of the cd drive in laptops for instance

Kimbie

We want to enable staff to use USB sticks, but only pre-approved hardware encrypted sticks...
 
Back
Top Bottom