How to enable USB/SD etc for students

[witch]

I must be missing something but I cant see what. I have been asked to enable the usb and sd card facility for students but for the life of me I cant find the policy that has disabled it!
Currently staff can access removeable storage but students cannot.
So my thinking is that the disabling must happen in a policy that only applies to the students.

We have a 'students' policy that is the only one directly applied to student users but it isnt in there. All other policies are applied to either more than one group of people, or to computers.
Any ideas where else I could be looking?

[VeryPC_Tom_M]

I'd try looking in

Computer Configuration - Administrative Templates - System - Removable Storage Access

and

Computer Configuration - Administrative Templates - System - Device Installation - Device Installation Restriction

They're the locations which pop into mind when restricting access to removable storage.

[witch]

Thanks, but it cant be in Computer Configuration, it has to be User, doesnt it? Staff can access drives wherever they are.
I was looking in removeable storage access.

I have had a look at installation and nothing is configured anyway.
No drives are hidden anywhere either

[witch]

Someone must know. I have looked through every single policy (clutching at straws, here) and nowhere is access to removeable storage disabled. So it is somewhere else?
As I said, Staff can access such things but students cant.

There is something I am missing - but what?

[SYNACK]

Could it be in the AV software, I know that some can happily block user access to all sorts of stuff based on the group.

I'd also do an RSoP for a student and a teacher then have a compare (or use GPO modelling in the group policy management thing in 2008 R2 which is probably easier).

[pete]

Loopback policy on the OU triggered by security group membership? (filter policy by security group - if you're a kid it applies, if staff it doesn't?)

What does Group Policy modelling show?

GPMC > Group Policy Modeling (second from bottom) - model against a kid on randomcomputer01, then against a member of staff on randomcomputer02 and compare.

You can also do stuff with device drivers and security groups (well, on XP at least you can).

[MYK-IT]

Are you using USBDLM to control devices/ports?

[Ergo]

Could it be simply that you have drive letters hidden for students which includes the drive letters which would be used by the removable devices? Off the top of my head I could not direct you to the policies, but something like:

User -> Policies -> Windows -> Explorer -> Hide all drive letters except...

David Irwin

[witch]

Drive letters not hidden - well, only the C drive as you would expect
Definitely not the antivirus
Dont know if I am using USBDLM - how do I tell?
Will look at Group Policy Modelling tomorrow
The machines are all windows 7 and this has only occurred siince we had our new server just before the summer break, so I KNOW it is something on there...somewhere...
The thing is that for the policy to apply to some groups and not others, the "disable" setting must be somewhere and I cannot find it.

[witch]

I have modelled a random child and a random staff member and can see no differences with respect to accessing USB drives etc. So, as I thought, it looks like it isnt done by group policy.
What else can I look at?
I need this sorted quickly because the staff are getting around it by logging on all the netbooks as staff so that the children can access the SD card. Obviously this is not good as the children can then access all sorts of things they shouldnt be able to , not forgetting profile corruption issues etc

[pete]

I have modelled a random child and a random staff member and can see no differences with respect to accessing USB drives etc. So, as I thought, it looks like it isnt done by group policy.
What else can I look at?
I need this sorted quickly because the staff are getting around it by logging on all the netbooks as staff so that the children can access the SD card. Obviously this is not good as the children can then access all sorts of things they shouldnt be able to , not forgetting profile corruption issues etc

What does the event log say when a removable device is plugged in by a kid?

[Mcshammer_dj]

are you using sophos

[witch]

No Sophos - NOD32 here

[witch]

Nothing happens when a child plugs in a USB.
Can anyone think of anything else I could look at? Getting a bit desperate here!

[SYNACK]

login as a teacher, plug in a usb key then log off and back in as a student to see if it keeps it mapped.

Boot with USB in then logon as student to see if it shows up

Check in drive manager as a student to see if the drive exists when plugged in as a student.