Re: Disabling USB mass storage

From: Glenn S. (glenn_at_secureinformation.net)
Date: 03/03/05

  • Next message: adisegna_at_siscocorp.com: "RE: Changing system time for testing and development" 
    To: "Martin a Marika TYDOROVCI" <tydy@szm.sk>, <focus-ms@securityfocus.com>
Date: Thu, 3 Mar 2005 14:33:20 -0500

    A glue gun or superglue works wonders. If that is too extreme there are some
    other options.

    Do you have SP2 installed? If yes then there are GPO's you can use. This
    site details a way to do it for both SP2 and earlier:
    I found it on a website that addresses the issue of read-only USB ports.
    The second section covers pre-SP2 machines. I have not tested it yet myself.
    http://www.gpanswers.com/faq/?id=10

    How do I prevent people from writing data to the USB port? (ie: USB Flash
    disk, etc)

    You can create an ADM template to do this.

    Here is the code to restrict XP/SP2:

    (This will 'Write Protect' the device, similar to flipping the tab on a
    floppy disk)

    CLASS MACHINE

    CATEGORY "USB Storage"

      POLICY "Write Protect USB Storage"
        KEYNAME "SYSTEM\CurrentControlSet\Control\StorageDevicePolicies"
        VALUENAME "WriteProtect"
        VALUEON NUMERIC 1
        VALUEOFF NUMERIC 0
      END POLICY
    END CATEGORY

    Save as a .ADM file, load it in, and go !

    or

    To prevent machines pre-XP/SP2...

    (This will disable the storage device completely, i.e no read or write)

    CLASS MACHINE

    CATEGORY "USB Storage"

      POLICY "Disable USB Storage"
        KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR"
        VALUENAME "Start"
        VALUEON NUMERIC 4
        VALUEOFF NUMERIC 3
      END POLICY
    END CATEGORY

    ----- Original Message -----
    From: "Martin a Marika TYDOROVCI" <tydy@szm.sk>
    To: <focus-ms@securityfocus.com>
    Sent: Wednesday, March 02, 2005 3:10 PM
    Subject: Disabling USB mass storage

    > Hi list,
    >
    > Does anyone knows a way to disable USB mass storage device in Win XP? I
    > need to disable using devices such as USB flash drive, card readers, etc.
    >
    > Regards
    >
    > ---------------------------------------------------------------------------
    > ---------------------------------------------------------------------------
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: adisegna_at_siscocorp.com: "RE: Changing system time for testing and development"

    Relevant Pages