Restrict Access To USB Devices

[MuppetQueen]

I hope I have posted this in the correct section...

How do you restrict access to USB devices for students. Our students seem to come into school with 1000s of £££ of electronic equipment and they are pretty smart too!?!

Do you have any software that you use? We are a Microsoft school (I know) with Server 2K3 and Windows XP.

[Ric_]

When you say devices, do you mean USB drives or full blown deices such as scanners, printers, etc?

(Beat this though, I had one kid bring his PSP to have a file copied onto it! That's one expensive way of transferring files!!!)

[adamyoung]

We'd also like to block USB pen drives (again we're a Microsoft Win 2003/XP network)

[Geoff]

Already answered this twice, lol.

http://www.edugeek.net/index.php?nam...ic&p=5517#5517
http://www.edugeek.net/index.php?nam...ic&p=6144#6144

Second link blocks CD/DVD/Floppy too if you like.

[Ric_]

@adamyoung: I've somehow managed to do this by mistake and I'm having hell's own job getting them to work - it's something in the Citrix policies though I feel.

[mac_shinobi]

Probably been answered already but for the heck of it disable it in the bios and then geoff or someone in the previous thread suggested a template I believe :0

[MuppetQueen]

Sorry, I didn't see the other threads - lol. Think I will be a Newbie for a while longer.

I did know how to restrict through GPO but this is by machine only. Staff use USB drives to take work home etc. I would just like to restrict on a per user basis.

Does anyone pay for any application that is not too expensive but does this job? I feel I may have to restrict to only the admin computers or those in the staff workroom. I don't trust any of the PCs/teachers in the classroom?!?

[Geoff]

I think designating paticular machines is the way to go. If only because you can turn up the antivirus to paranoid on those machines.

[MuppetQueen]

Thanks again Geoff. I think you are probably right. It's just sometimes difficult to get staff to see the dangers.

Will speak to SMT and implement.

Cheers

[mac_shinobi]

Just out of curiousty :

If you had an application that would enable / disable USB would that allow you to do it on a per user basis ?

[mac_shinobi]

what about this :

http://techrepublic.com.com/5208-624...sageID=1678065

[mac_shinobi]

Here is something else as well with regards to what microsoft have to say about it :

http://www.hannesschmidt.de/node/29

[mark]

Y'know I had the opposite problem - no one could access USB devices. The reason was that for the first available device I'd mapped a network share, so the USB device was effectively hidden.

So... :P

For staff leave a drive letter available before the 1st mapped drive letter, and the students [or however you want to set it in GPO], don't leave a gap.

The only problem with this bodge is that if you have differring numbers of devices in machines - but then you could get around that by assigning drive letters at the end of the alphabet.

[carries on conversation with self! lol!]

[ChrisH]

Virtually alll my work stations just have a HD and no other drives. I just restrict C: for staff and C: and all others for students.

[Roger]

Geoff,
I get an error message when I try to add this template:-

The following error occured in
\\lancasterhigh.lancs.sch.uk\sysvol\lancasterhigh. lancs.sch.uk\Policies ....
adm on line 19:
Error 51 Unexpected keyword

Found: CATEGOR
Expected: CATEGORY

The file cannot be loaded.

I have double checked the text entry, CATEGORY is spelt correctly !!

Have you used this template successfully?

Ta, Roger