Disabling USB pen drives

Archived from groups: microsoft.public.win2000.security (More info?)

Hello,

I want to prohibit to all users, except Administrators,
the installation of any USB pen drive, can anybody tell
me how to do it with policys?

Archived from groups: microsoft.public.win2000.security (More info?)

Thing is, that reg key affects only drives that use USBSTOR.SYS. Not all
drives do.

What risk are you trying to mitigate by doing this? I assume you're
concerned about people copying information onto the drives and then taking
it with them. What about these other ways of exporting information:

* USB drives that install their own drivers
* digital cameras and MP3 players
* 1394 firewire drives
* CD and DVD recorders
* parallel port hard drives
* floppy disks
* infrared port or network transfer to other computers
* print outs
* digital photographs and screen captures
* telephone dictation

If someone wants to make off with data from your computers or network and
they've got access, generally they will be able to accomplish their goals. A
product like Rights Management Services can be very helpful here, but even
RMS won't stop what we call "analog attacks," like for instance placing the
monitor face on a photocopier and pressing the print button.

Steve Riley
steriley@microsoft.com


"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:5ZY8d.192207$MQ5.50104@attbi_s52...
> There is built in way to do such with Group Policy. You might want to try
> one of the various third party programs that can control such or see the
> KB link on using a registry mod to limit USB storage. --- Steve
>
> http://support.microsoft.com/defau [...] -us;823732
> http://www.protect-me.com/dl/ -- DeviceLock
> http://www.reflex-magnetics.com/products/disknetpro/ -- Reflex Disknet
> Pro
>
> "EDuardo" <anonymous@discussions.microsoft.com> wrote in message
> news:3fba01c4ab8b$33fd0400$a301280a@phx.gbl...
>> Hello,
>>
>> I want to prohibit to all users, except Administrators,
>> the installation of any USB pen drive, can anybody tell
>> me how to do it with policys?
>
>