none
Issue GPO User Disable/Enable CD device access (re-enable problem)

    Question

  • Hello,

    I've a problem with User GPO. I need enable and disable CD/DVD access to user groups.

    When I enable GPO for Disable CD/DVD Access, it works fine (the user cannot access to CD/DVD device), but if I want enable access to this resource again, it doesn't work IN THE SAME MACHINE. If user access in another computer, he have access to CD/DVD device.

    There are: User Configuration - Policies - Administrative Template - System - Removable Storage Access - CD and DVD: Deny read access/CD and DVD: Deny write access

    DCs: Windows 2008 R2 (English)

    Client: Windows 7 Pro (English)

    Any suggestion.. ???

    Regards,

    Pedro

    Saturday, May 19, 2012 6:32 PM

Answers

  • Hi,

    How are you doing to enable CD/DVD to users? I mean, you don't really need to do anything else than do not apply the GPO as the device access is granted by default.

    So, the environment under my POV should be:

    - Create GPO with CD/DVD access denied in the Users section

    - Link GPO to users container OU and filter GPO execution to a security group including the affected users.

    - Everytime you need to enable a users CD/DVD access just take him out of the security group

    If you want to speed up the process, once it's done execute a gpupdate /force from user computer.

    If you still have any issue, please check from rsop.msc which GPO is causing the problem

    Regards,

    Julio Rosua

    • Marked as answer by pvelasco Friday, May 25, 2012 12:19 PM
    Saturday, May 19, 2012 8:34 PM

All replies

  • Hi,

    How are you doing to enable CD/DVD to users? I mean, you don't really need to do anything else than do not apply the GPO as the device access is granted by default.

    So, the environment under my POV should be:

    - Create GPO with CD/DVD access denied in the Users section

    - Link GPO to users container OU and filter GPO execution to a security group including the affected users.

    - Everytime you need to enable a users CD/DVD access just take him out of the security group

    If you want to speed up the process, once it's done execute a gpupdate /force from user computer.

    If you still have any issue, please check from rsop.msc which GPO is causing the problem

    Regards,

    Julio Rosua

    • Marked as answer by pvelasco Friday, May 25, 2012 12:19 PM
    Saturday, May 19, 2012 8:34 PM
  • Try use the command gpupdate /force to update the GPO.

    If it still doesn't work, run command gpresult /h gpreport.html to check if the gpo was applied.

    Regards,

    Miya


    Miya Yao

    TechNet Community Support

    Wednesday, May 23, 2012 3:55 AM
  • check for the registry key "security" under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE and delete ist --> h**p://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/fcee7fc2-b430-4a55-a68d-2386287da9a3
    Friday, January 25, 2013 12:59 PM
  • hi

    best solution to "prevent" this problem is :

    step 1 - set this policy " all removable storage classess: deny all access " = disabled on ou that contain subject users and gpupdate /force on server and clients then logon off user and logon and check this right

    step 2 -  set this policy " all removable storage classess: deny all access " = enabled on ou that contain subject users and gpupdate /force on server and clients then logon off user and logon and check this  deny right

    in this moment if you want redisable this policy its done and after gpupdate /force on server and clients then logon off user and logon and check this  deny right its applied .

    excuse me for bad english writing , but this solve my problem after some day tray and check .

    bye


    Monday, March 18, 2013 12:08 PM
  • I found out Microsoft has a Hotfix for this specific issue. Gpupdate does not work because simply not having the policy enabled does not re-write the registry to allow access again. Try downloading KB2738898 and see what results you get:

    • Proposed as answer by FoaRyan Thursday, July 17, 2014 9:36 PM
    Thursday, July 17, 2014 9:36 PM