Prevent use of USB keys on client PC's

Associate
Joined
28 Nov 2002
Posts
766
Location
Down the road
Is there any way I can prevent users sticking in a USB memeory PC into their PC's and taking data off the network and home with them?
Im locking down what users can and cannot copy to/from the works PC's and wondered if there was anything in group policy that would allow me to prevent them from simply inserting a USB key for example and copying data to/from it.

What are the best practices for securing a network in this way?

Thanks
 
Associate
Joined
5 Feb 2004
Posts
342
Location
Rotherham
I'd use GPO, but you could also use the registry if you like

location = HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies.
key = WriteProtect
type = REG_DWORD
value = 1
 
Soldato
Joined
21 Oct 2002
Posts
18,022
Location
London & Singapore
Spider said:
If its configurable throught a GPO (as linked above), can i ask why people are buying and using 3rd party software for it?
Because it was only added to GPO relatively recently, IIRC with XP SP2. Hence why third party software exists and still exists for the issue...
 
Caporegime
Joined
12 Mar 2004
Posts
29,913
Location
England
At our school they have disabled usb pens, its extreemly annoying, we couldnt bring work in, take work home, backup our work, it was a very bad idea, luckily its easy to get around (just transfer files over the internet), but I think disabling pens should be a last resort, it would be easier to deny permission to copy certain files from the drive, I mean what sort of stuff do you have on there, government secrets?
 
Last edited:
Soldato
Joined
18 Oct 2002
Posts
7,765
Energize said:
I mean what sort of stuff do you have on there, government secrets?

Our salesman all have access to the customer master list, which could be of considerable value to our competitors. Don't want that getting out on usb key!
 
Caporegime
Joined
12 Mar 2004
Posts
29,913
Location
England
Then just deny access to it? If they already have access to it, wether pens are disabled or not they could copy it and so it makes no difference disabling usb, other than causing inconvience.

If I couldnt trust someone with the file I wouldnt give them access to it tbh.
 
Last edited:
Soldato
Joined
21 Oct 2002
Posts
18,022
Location
London & Singapore
Energize said:
At our school they have disabled usb pens, its extreemly annoying, we couldnt bring work in, take work home, backup our work, it was a very bad idea, luckily its easy to get around (just transfer files over the internet), but I think disabling pens should be a last resort, it would be easier to deny permission to copy certain files from the drive, I mean what sort of stuff do you have on there, government secrets?
In a school there's really no reason for them to disable USB storage drives. Have you spoke to the admin about it?

But in government and corporation organisations it is an invaluable security tool. It prevents employees either delibrately or accidently creating duplicates of sensitive files that shouldn't be taken off the central server.
 
Caporegime
Joined
12 Mar 2004
Posts
29,913
Location
England
You'd just set the permissions so that you cant copy any of the files on the server. Because disabling usb drives doesnt do a thing with all the other ways of copying them. People that cant be trusted should not be given access to the files.



The admin locked it out because people were running programs straight from the drives.
 
Back
Top Bottom