locked
USB Block For Standard Users in Windows 7 RRS feed

  • Question

  • Hi I have two Standard users in my Windows 7 PC and i want to block USB port for a specific Standard User in my windows 7 PC so that they could not use Flash drive or any other USB storage device in USB port. But at the same time i want to use USB mouse and Keyboard in the PC for that user.

    Can anyone suggest me how could i do it?


    Thursday, December 4, 2014 7:57 AM

Answers

  • Hi,

    if you need to disable the mass storage or any device you can use the devcon command  with disable option

    for usb (mass storage) or othe device  you can use with generic Device id

    http://msdn.microsoft.com/en-us/library/windows/hardware/ff544746(v=vs.85).aspx#ddk_example_30_disable_devices_by_an_id_pattern_tools

    Thanks,

    Israel Chemo.

    • Proposed as answer by Carey FrischMVP Friday, December 5, 2014 6:35 AM
    • Marked as answer by Roger Lu Monday, December 22, 2014 10:14 AM
    Thursday, December 4, 2014 9:59 AM
  • Hi

    To block new USB Storage Devices, you can create set deny permission on the following files for users you want to denied

    • %SystemRoot%\Inf\Usbstor.pnf
    • %SystemRoot%\Inf\Usbstor.inf

    but for USB storage device whch is already installed on the computer, then setting is PC specific.

    You can refer to the following KB for more information(the instruction is similiar to Windows 7)

    http://support.microsoft.com/kb/823732

    You can also use group policy to achieve this:User Configuration\Administrative Templates\System\Removable Storage Access,

    as describerd in the link below:

    http://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx

    To apply the group policy on non-admin accounts, you need to launch group policy editor in this way.

    run mmc to launch the Console, then scroll down to Group Policy Object, add this option, then follow that wizard, choose non administrators:

     


    Yolanda Zhu
    TechNet Community Support

    • Proposed as answer by Carey FrischMVP Friday, December 5, 2014 6:35 AM
    • Marked as answer by Roger Lu Monday, December 22, 2014 10:14 AM
    Friday, December 5, 2014 6:13 AM

All replies

  • Hi,

    if you need to disable the mass storage or any device you can use the devcon command  with disable option

    for usb (mass storage) or othe device  you can use with generic Device id

    http://msdn.microsoft.com/en-us/library/windows/hardware/ff544746(v=vs.85).aspx#ddk_example_30_disable_devices_by_an_id_pattern_tools

    Thanks,

    Israel Chemo.

    • Proposed as answer by Carey FrischMVP Friday, December 5, 2014 6:35 AM
    • Marked as answer by Roger Lu Monday, December 22, 2014 10:14 AM
    Thursday, December 4, 2014 9:59 AM
  • Hi

    To block new USB Storage Devices, you can create set deny permission on the following files for users you want to denied

    • %SystemRoot%\Inf\Usbstor.pnf
    • %SystemRoot%\Inf\Usbstor.inf

    but for USB storage device whch is already installed on the computer, then setting is PC specific.

    You can refer to the following KB for more information(the instruction is similiar to Windows 7)

    http://support.microsoft.com/kb/823732

    You can also use group policy to achieve this:User Configuration\Administrative Templates\System\Removable Storage Access,

    as describerd in the link below:

    http://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx

    To apply the group policy on non-admin accounts, you need to launch group policy editor in this way.

    run mmc to launch the Console, then scroll down to Group Policy Object, add this option, then follow that wizard, choose non administrators:

     


    Yolanda Zhu
    TechNet Community Support

    • Proposed as answer by Carey FrischMVP Friday, December 5, 2014 6:35 AM
    • Marked as answer by Roger Lu Monday, December 22, 2014 10:14 AM
    Friday, December 5, 2014 6:13 AM