Disable USB drives for specific users

Все ответы

• 1 июля 2009 г. 10:07Meinolf Weber [MVP-DS]MVP

   
  

  0

  Войдите в систему, чтобы проголосовать
  Hello,
  
  use this way and configure access for a specific domain user group with the needed accounts:
  http://support.microsoft.com/kb/823732

  ---

  Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
  • Ответить
  • Цитировать

   
• 1 июля 2009 г. 10:26emytjls

   
  

  0

  Войдите в систему, чтобы проголосовать
  Thanks for the prompt response.
  I did come across this article. The first part "If a USB storage device is not already installed on the computer" would be of some help but a lot of the students have previously connected the devices. The trouble is the second part "If a USB storage device is already installed on the computer" involves changing a registry key in HKEY_LOCAL_MACHINE which will then prevent any subsequent user that logs on from using a USB drive.
  
  Thanks
  
  Jason
  • Ответить
  • Цитировать

   
• 2 июля 2009 г. 7:21Mervyn ZhangMSFT, Модератор

   
  

  0

  Войдите в систему, чтобы проголосовать
  Hi Jason,
  
  As far as I know, we could not prevent a computer group policy from applying when certain user/group logs on or computer configuration applys only to certain users.
  
  Computer-related Group Policy (or computer configuration) is applied when the operating system initializes and during the periodic refresh cycle. In general, computer policy takes precedence over conflicting user policy. Thus, it is not possible to configure a computer configuration, such as the Hardware policy, to apply to specific users.
  
  Thanks.
  

  ---

  This posting is provided "AS IS" with no warranties, and confers no rights.
  • Ответить
  • Цитировать

   
• 2 июля 2009 г. 14:30Nitesh Bhardwaj

   
  

  0

  Войдите в систему, чтобы проголосовать
  Hi
  
  We can certainly Disable USB usage on all computers or for a group of people
  
  1) we need to create a GPO for this or add in existing GPO to target machines. Following registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
  Needs to be added to file system control in GPO & give Deny to all. This will disable this registry entry on all machines which will recieve this settings.
  This registry stores the driver info for USB device, if this location is disabled usb driver will not load for any external USB device.
  
  2) we can use GPO filtering for deploying this policy only on a group of users wherever they login in domain. To perform this Add these users in security filtering of GPO & assign Apply gpo right, do Not assign to authenticated users if u want to specify for some users.
  
  I have tested & deployed this solution in production environments.
  
  Thanks
  

  • Помечено в качестве ответаMervyn ZhangMSFT, Модератор10 июля 2009 г. 1:30
  •  
  • Ответить
  • Цитировать

   
• 8 июля 2009 г. 2:06Mervyn ZhangMSFT, Модератор

   
  

  0

  Войдите в систему, чтобы проголосовать
  Hi Jason,
  
  Could you please confirm whether Nitesh’s suggestion resolves your problem.
  
  Thanks.
  

  ---

  This posting is provided "AS IS" with no warranties, and confers no rights.
  • Ответить
  • Цитировать