none
Deny all removable storage (USB) via User policy (computer works fine)

    Question

  • 2012 R2 domain

    Windows 8.1

    I am having an issue denying all removable storage devices via user policy with GPO (computer policy works fine). Has anyone else experienced this or knows how to fix it so that the policy can be applied to users?

    TIA!

    Friday, January 15, 2016 8:11 PM

Answers

  • The policy was being applied according to gpresult but the registry key was not being created.

    So the policy actually didn't get applied.
     
    I have tested this in my local lab, after appling this user based policy, the associated registry key got created correctly:
     
    User Configuration\Policies\Administrative Templates\System\Removable Storage Access\All Removable Storage classes: Deny all access
     
    Is this the specific policy setting that you are referring to? Try to log off and log in, then verify again.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Tuesday, January 26, 2016 5:06 AM
    Moderator

All replies

  • Hi,
     
    Could you please share more details on how exactly you configured this policy?
     
    Please try to run "Gpresult /h C:\result.html" on the faulty client machine and see if the policy setting has been applied on the machine successfully.
     
    Also, check if the associated registry key was created on the machine:
     
    Key Path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\RemovableStorageDevices
    Value name: Deny_All
    Value data: 1
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Monday, January 18, 2016 6:08 AM
    Moderator
  • Hi,
     
    Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
     
    Thanks,
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Friday, January 22, 2016 2:13 AM
    Moderator
  • Thanks for your reply Ethan.

    The policy was being applied according to gpresult but the registry key was not being created. This isn't the first time I've run into issues applying a USB lockdown policy via users instead of computers.

    Have you been able to verify that the user policy does indeed work?

    Friday, January 22, 2016 2:31 AM
  • The policy was being applied according to gpresult but the registry key was not being created.

    So the policy actually didn't get applied.
     
    I have tested this in my local lab, after appling this user based policy, the associated registry key got created correctly:
     
    User Configuration\Policies\Administrative Templates\System\Removable Storage Access\All Removable Storage classes: Deny all access
     
    Is this the specific policy setting that you are referring to? Try to log off and log in, then verify again.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Tuesday, January 26, 2016 5:06 AM
    Moderator
  • Hi, 
     
    How is it going? Please let us know if you would like further assistance.
     
    Thanks,
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Friday, January 29, 2016 9:49 AM
    Moderator
  • Hi,
     
    I'm marking the reply as answer as there has been no update for a couple of days.
     
    If you come back to find it doesn't work for you, please reply to us and unmark the answer.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Wednesday, February 3, 2016 1:28 AM
    Moderator