RE: Disabling USB mass storage

From: Steven Hay (shay_at_communitysavings.ca)
Date: 03/03/05

  • Next message: Beauford, Jason: "RE: Restrict running applications from usb key" 
    To: "'focus-ms@securityfocus.com'" <focus-ms@securityfocus.com>
Date: Thu, 3 Mar 2005 13:52:31 -0700

    Good topic question, one we're having issues with as well, but with XP SP1.

    We want to disable any removable drives from working on our 400+
    workstations without having to visit each one.

    I tried denying access to usbstor.sys in the GPO, and confirmed that the
    policy was applied to our test system. But it seems like the system
    privliges override the GPO rights (I'm guessing) as the removable drive
    letter pops up and is usable when a USB drive is connected.

    Anyone have any experience with locking these down using GPO?

    Steve

    -----Original Message-----
    From: Moser, Scott [mailto:scott.moser@smead.com]
    Sent: March 3, 2005 12:40 PM
    To: Martin a Marika TYDOROVCI; focus-ms@securityfocus.com
    Subject: RE: Disabling USB mass storage

    Create new key HKLM\System\CurrentControlSet\Control\StorageDevicePolicies
    and then create REG_DWORD called WriteProtect and set to 1. This will
    prevent write only (not read) in XP SP2 only.

    -----Original Message-----
    From: Martin a Marika TYDOROVCI [mailto:tydy@szm.sk]
    Sent: Wednesday, March 02, 2005 2:10 PM
    To: focus-ms@securityfocus.com
    Subject: Disabling USB mass storage

    Hi list,

    Does anyone knows a way to disable USB mass storage device in Win XP? I
    need to disable using devices such as USB flash drive, card readers, etc.

    Regards

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
Please note that Internet email is not always private, secure or reliable.
The sender accepts no liability for any damages caused by any virus
inadvertently transmitted with this email.  Any opinion expressed in this
email is solely that of the author, unless clearly indicated otherwise.
This email, and any attachments, may contain confidential and/or proprietary
information that is intended only for use by the addressee.  If you are not
the intended recipient, any use, dissemination, forwarding, printing, or
copying of this email is strictly prohibited.  If you received this email in
error, please delete the email and advise the sender of the delivery error.
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Beauford, Jason: "RE: Restrict running applications from usb key"

    Relevant Pages

    • RE: Disabling USB mass storage
      ... Subject: Disabling USB mass storage ... Removable drives, yes. ... >the intended recipient, any use, dissemination, forwarding, printing, ...
      (Focus-Microsoft)
    • RE: Disabling USB mass storage
      ... Removable drives, yes. ... If we can do it by GPO then we're hoping we can decide what systems/users ... >Subject: Disabling USB mass storage ...
      (Focus-Microsoft)
    • RE: Disabling USB mass storage
      ... Create a seperate GPO "Deny USB Mass Storage" and apply it to who you want ... Within that GPO ... Subject: Disabling USB mass storage ... >We want to disable any removable drives from working on our 400+ ...
      (Focus-Microsoft)
    • RE: Disabling USB mass storage
      ... >Anyone have any experience with locking these down using GPO? ... We want to disable any removable drives from working on our 400+ ... Subject: Disabling USB mass storage ...
      (Focus-Microsoft)
    • RE: Disabling USB mass storage
      ... You really need to look into the power of GPO I think. ... Reg tool from desktopstandard.com, We use the full package (Policy ... Subject: Disabling USB mass storage ... >the intended recipient, any use, dissemination, forwarding, printing, ...
      (Focus-Microsoft)