none
USB mass data drive, flash drives

    Question

  • On SBS2011 can you block access to USB ports to stop users downloading company data to flash drives etc on client computers, by a group policy edit?

    Can you also set it so a admin logon can temporarily allow this use?

    Thanks

    Charles 

    Wednesday, September 16, 2015 8:43 AM

Answers

All replies

  • Hi Charles,
     
    We can block access to USB drives in group policy, the path to the policy setting is:
     
    Configuration > Policies > Administrative Templates > System > Removable Storage Access
     
    There are several policies you can configure there, if you just want to stop users from writing data to USB drives, then you can configure "Removable Disks:  Deny write access." You can also disable read access as well.
     
    If you want to exclude admin from this GPO, you can organized your non-admin users in one security group, then change the scope of the policies:
     
    http://social.technet.microsoft.com/wiki/contents/articles/16845.locking-down-removable-storage-access-using-group-policy-and-security-groups.aspx
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Friday, September 18, 2015 5:37 AM
    Moderator
  • You can do it through Group policy 

    1) Create GPO or edit your current GPO- Goto  User configuration –> Policy –> Administrative template –> System –> Removable storage Access and Enable deny Read/Write Access.

    You can configure register to block USB's,

    2) Create GPO or edit your current GPO - Goto User configuration –> Policy –> Administrative template --> Registry -->New registry item -->


    Then save it.


    Friday, September 18, 2015 6:01 AM