none
How to create Group Policy to disable USB access to users

    Question

  • Hi,

    We are running domain controller on windows server 2008 R2 and we have xp and win 7 client machines.We need to disable usb access for users and allow access to few users through group policy.one more criteria is users should able to use data cards.How to do this using group policy.?

    Regards

    Asha


    Tuesday, May 24, 2011 12:24 PM

Answers

  • Have a look to this Microsoft article about how to use group policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers:

    http://support.microsoft.com/kb/555324/en

     

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

    Tuesday, May 24, 2011 1:32 PM
  • Hi,

     

    For Windows 7 computers you can use a Group Policy object setting to deny the installation of USB drives. This method provides a very granular method of controlling individual USB devices. With this method you will need to discover the USB ID for the device. The ID will then be used in the policy to control the USB device. You can either deny the USB device or allow the USB device. You can craft your own USB device matrix of what is allowed and what is denied. For more information, please refer to the following link:

     

    http://technet.microsoft.com/en-us/library/cc731387(WS.10).aspx   

     

    For Windows 7 clients, you can also refer to the following policy:

     

    [Computer Configuration\Administrative Templates\System\Removable Storage Access]

     

    Thanks.

    Nina


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, May 31, 2011 9:46 AM
    Moderator

All replies

  • Have a look to this Microsoft article about how to use group policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers:

    http://support.microsoft.com/kb/555324/en

     

     


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Microsoft Student Partner
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

    Tuesday, May 24, 2011 1:32 PM
  • Hi,

     

    For Windows 7 computers you can use a Group Policy object setting to deny the installation of USB drives. This method provides a very granular method of controlling individual USB devices. With this method you will need to discover the USB ID for the device. The ID will then be used in the policy to control the USB device. You can either deny the USB device or allow the USB device. You can craft your own USB device matrix of what is allowed and what is denied. For more information, please refer to the following link:

     

    http://technet.microsoft.com/en-us/library/cc731387(WS.10).aspx   

     

    For Windows 7 clients, you can also refer to the following policy:

     

    [Computer Configuration\Administrative Templates\System\Removable Storage Access]

     

    Thanks.

    Nina


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, May 31, 2011 9:46 AM
    Moderator