How to deny users plug USB Storage devices?

I want deny my users to connect USB storage devices. Windows permits users,
even non-administrators to plug USB flash devices.

You can modify file permissions on usbstor.* files inside %windir%* (3
files) and deny acces to every registry entry where the "USBSTOR" string is
present.
Before doing this you must uninstall any USB flash device.

I've try this configuration locally and works only when you remove all
permissions, even for SYSTEM accoun. I don't know how to deploy it through
domain policy or login-script and of course, I don't want to remove SYSTEM
account permission over any registry key or system file.

There's any solution to that question (3rd party software not accepted for
answers :p)

Thank you.

Juanma
--

robgruen
Wed Nov 26 10:53:44 CST 2003

Juanma,

Have you considered disabling the USB hub (either from the device manager
or through the BIOS)? If you disable the hub from the BIOS and password
protect the BIOS you users will not be able to use any USB devices. If you
disable the device in the device manager, only power users will be able to
run the device manager.

Or per Q283658 (http://support.microsoft.com/?id=283658) you can deny the
"Load\Unload Drivers" privilege for those users you don't want to use USB
devices. However, I don't know if this will work for USB devices that
already have drivers within the system32\drivers folder.

I hope that helps!

Thanks! Robert Gruen
Microsoft, VB.NET

This posting is provided "AS IS", with no warranties, and confers no rights.