Using PowerShell you can do it as below
http://stackoverflow.com/questions/12812078/disable-enable-usb-drivers-without-reboot-with-c-c-powershell-in-windows-7
In Windows Server 2008 domain, there are a set of built-in policies on removable storage access and installation. It makes restricting USB mass storage device more easier.
1. Computer Configuration-->Policies-->Administrative Templates-->System-->Removable Storage Access
User Configuration-->Policies-->Administrative Templates-->System-->Removable Storage Access
It specify read and write permission on all kinds of removable storage device.
2. Computer Configuration-->Policies-->Administrative Templates-->System-->Device Installation-->Device Installation Restrictions
With device installation restrictions, the installation of removable storage device will be totally under control.
More detailed information:
Managing Hardware Restrictions via Group Policy
http://www.microsoft.com/technet/technetmag/issues/2007/06/GroupPolicy/default.aspx
But the minimum client requirement is Windows vista/Win7.So this is no good for my Windows XP machines.
If you have win2003 and WinXP clients for easy managibility of USB group policy.Created Computer OU in the same OU created two sub OU (EnableUSB and DiableUSB OU) and applied the usb disable gpo ADM template to DisableUSB OU and usb enabled policy ADM template
to EnableUSB OU.
Computer OU
--USBEnable...Apply usb enabled policy(template)
--USBDiable...Apply usb disable policy(template)
Refer below link for the ADM template
You also need to give deny permission on usbstor.inf and usbstor.PNF to disable the USB else the diable policy will not work.Also set allow permission to usbstor.inf and usbstor.PNF file and attach the gpo to USbdisable and usbenable GPO accordingly.
Computer Configuration\Windows setting\security settings\File system Add
%SystemRoot%\inf\usbstor.inf
%SystemRoot%\inf\usbstor.PNF
set deny permission to administrator,authenticated user,everyone,SYSTEM,users.
Simarly set allow permission to administrator,authenticated user,everyone,SYSTEM,users
Referencelink:http://www.petri.co.il/disable_usb_disks_with_gpo.htm
Once done you can move the computer to USBEnable or USBDisable OU.If there is requiremet to enable the USB or disable the conputer USB you can move the require computer object to appropiate OU to receieve the appropiate policy.However for setting to take
effect you need to reboot the Computer.
Hope this helps
Best Regards,
Sandesh Dubey.
MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator |
My Blog
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
