Block USB for entire school

[RobD]

Hi,

 

I'm thinking about blocking usb drives and thought I ask you all if you block USB drives and if so how?

 

I'm thinking about blocking via GPO but have used device wall but not sure if it would be best in a School environment.

 

Thanks

 

Rob

[StevieM]

I would be strung up if I even mentioned the idea of blocking USB drives for staff. I have to rely on up-to-date AV and UAC.

[chazzy2501]

I block mine via GPO for all curriculum machines. if a pupil needs a file he can use the VLE or email. or in the worst case bring it to me. Teachers and admin still have use access.

[FN-GM]

You will need to take into account that Windows will class a digital camera (mayabe memory cards as well) as a USB device.

[RichCowell]

I use Impero Software) to block things like USB - you can do it for specific users / groups (rooms)...

 

Works nicely, though quite expensive if you don't need all the other many features...

[jonnykewell1]

The senior technician blocked USB drives in my previous school using a combination of sophos endpoint and USBDLM's password facility. Was always abit of a pain especially if us technicians wanted to use our memory sticks as we had 2 levels of block to bypass. USBDLM only allowed about 10 exceptions in it's .ini file too so for certain people who we allowed access to devices we were limited. As mentioned above memory card readers were blocked, printers with memory card readers built in became a problem and sound recorders for oral exams. You would then need to provide some sort of solution for staff to transfer files from work to home and vice versa (for this we used home access+), and you always get certain staff members who have gigabytes of files that they MUST have so it gave us a whole load of extra work transferring files for them (only after virus scanning the drives) which took an age. :-)

[6Foot2]

Use USB Drive Letter Manager for Windows to ensure that they get USB drive letters that you want them to have and then use Group Policy to make those drive letters inaccessible to targeted users?

 

Link: USB Drive Letter Manager - USBDLM

[RobD]

Thanks all, appreciate the help. We have impero but must admit didnt realise you could block USBs with it.

 

We havnt discussed it with staff yet so to be honest its a bit of a fact finding missing but you've all provided some great advice. Thanks

[Valyyn]

If it helps, click on the group of students (or Entire Network), then on the Group tab up top is Disable USB Storage. Really handy

[reprised]

We block usbs at our school using sophos enterprise console. We block all curriculum machines but allow our admin, teacher and iwb machines. You can block groups of computers and admins can still use usbs on machines that are blocked. Works really well

[Cemito]

We also have USB's blocked for students but we allow teachers to use USBs.. Just got Ranger Portico working so students can access their mapped drive from the Internet so they can download their files to their computers or upload documents to their mapped drive.

[Mr_Jiminy]

I block mine via GPO for all curriculum machines. if a pupil needs a file he can use the VLE or email. or in the worst case bring it to me. Teachers and admin still have use access.

 

How is this done via GPO? Does it depend of the age of the server OS?