Students denied access to usb

[witch]

I'm sure this is an easily answered question.
My server is currently set up so that students cannot access anything plugged into a USB. The item is installed and you can see the folders but get an 'access denied' if you try to click.
This is a pain as we have video cameras that the children are using for various projects but currently they cant access their films etc, a staff member has to sort it out and put the files on a shared area.
Can someone tell me where this setting will be? And if I sort it out, I would like to deny the students the possibility of running any .exes off their usb sticks.

I found the bit under computer configuration - \User Configuration\Policies\Administrative Templates\System\Removable Storage Access but it is not configured so I dont think this is where the restriction is coming from.
Staff can use usb so there must be something different somewhere!

[SYNACK]

Can you run RSoP snapin in mmc to see all the applied settings then filter it by the term usb

[AngryTechnician]

Have you run RSoP on an affected workstation and user to see if its hidden in another policy somewhere?

Edit: What he said ^

[Iain.Faulkner]

Hi Witch,

Don't know if any use of not, but we do USB blocking through our AV.

[witch]

Definitely not done that way here. I just cant see where it is done. We have separate staff and student gpos and logic would say that that would be where to find the restriction, but apparently not!

[witch]

Have you run RSoP on an affected workstation and user to see if its hidden in another policy somewhere?

Edit: What he said ^

What is that? Where do I find it?

(it's done by user, not computer, definitely)

[Steve21]

What is that? Where do I find it?

rsop.msc (Run it from start menu, or go and add it as a snapin to normal management msc)

Steve

[witch]

rsop.msc (Run it from start menu, or go and add it as a snapin to normal management msc)

Steve

Sorry, no clue..I have added it I think. Now what? Start menu on what?

[Steve21]

Sorry, no clue...How do I add it? Run it from start menu where?

Start box thingy, Run box (Or "Run button" if XP I guess)

Either rsop.msc to go straight to it, or mmc to get to management console, then add the snapin.

Steve

[witch]

I have added it but now it is asking where to save it - and the technet doc I am following doesnt mention that - help?

And if I try to run it I get an RSP server not available error

[Steve21]

You shouldn't need to save it, that's only saving the layout in MMC. If you right click the rsop, and generate data, you can pick the user it'll run under (those who have logged onto it before), and it'll list the policies that applied to them.

Steve

[witch]

If I run it from the computer it only gives me the settings for the current user. What am I missing? I need to see the student settings

[SYNACK]

Run it on a client, when you generate data you can pick the user to generate it for, as long as a student has logged on to the machine before they should be on the list.

[witch]

What list? When I type it in to a computer, I get a window giving me the username - which is me and not a student, and then it resolves into what looks like the standard "edit" screen you get when looking at a policy - Computer config, user config and all this. I am obviously doing something wrong but I cant see what

[SYNACK]

new plan, 2008r2 also has gpo modelling, its an option in the group policy management snapin, this should let you pick a user and machine to test for.