Allow School Purchased USB's Only...

[GRitchie]

I was wondering if anyone knew a way to lock down USB's, so that staff/students can only use school purchased devices?

That way, we can ensure they're encrypted and they're not going to be easily compromised if taken by the wrong people.

 

I was thinking of doing it so simply to the point of having a hidden text file with a hash code that the machine would check on insertion. In hindsight that wouldn't work because the drive would be encrypted on insertion.

 

 

ideas?

[RichCowell]

I think the USB Tracking on Impero can do that - though it's not a feature I've tried... As you've already got Impero it's probably something @Dan_Impero can advise on further? Edited March 1, 2016 by RichCowell

[GRitchie]

Can it? That sounds like it may be the way to go then if so.

We do have Impero. Not currently deployed, in the process of removal so we can redeploy it again more cleanly. But when it's out, that would work.

[RichCowell]

I think so - we've not needed to look into it here, so I've not bothered...

 

5.2.10 was released yesterday, so it'd be worth asking them to install that for you...

[GRitchie]

Yeah, I saw there was a newer release from the latest. Will get those MSI's before deploying!

Thanks.

[ITGuyWestMidlands]

Usb bitlocker and enforce it via group policy

[GRitchie]

Can you give a bit more detail? Enforce bitlocker do you mean?

[daneil16]

Yep we currently use Impero Sentry Stick utility to allow only 3 encrypted USB sticks for staff to use.

 

Very simple to use, check out Impero's Youtube videos.

 

How I would be lost without Impero :-)

[GRitchie]

For anyone else looking, I assume this is the tut:

https://www.youtube.com/watch?v=6vmd8HECoSE&index=16&list=PLzHOEi2fNNTwKbhuYtLpC8idQH7PYEQHS

[adamholt1]

Yes - only encrypted USB sticks here.

 

All done through Sophos Console.

 

Is a bit of a pain when someone wants a memory card but can allow that particular device / period of time.

 

Works well and all staff on board with it. Have a few certain computers/laptops which allow all USB devices such as ICT and the main meeting room where external's come with their important presentation on a unencrypted stick.....Can't be that important but lets not go there!!

[ITGuyWestMidlands]

If you have windows 7 enterprise you can Use bitlocker to encrypt usb devices. You can then enforce specific options via group policy such as allow read only on unencrypted devices or enforce that all devices must be bitlocker encrypted. Trouble is that it's a computer setting but you can apply per users using gpp registry options.

[Dan_Impero]

Can it? That sounds like it may be the way to go then if so.

We do have Impero. Not currently deployed, in the process of removal so we can redeploy it again more cleanly. But when it's out, that would work.

 

Hi @GRitchie,

 

Sorry for the delayed response, there are two options with the Impero USB tracking functionality which you could consider for this:

 

1) USBs can be 'allowed' based on their serial number, so you could set Impero to only 'allow' each of your school USBs

 

2) Alternatively you could set up BitLocker on each of your school USBs and set Impero to only allow USBs which have had BitLocker applied

 

If you'd like more detail on this functionality there is an article on our Knowledge Base, accessed via the Impero Customer Portal, or alternatively you can contact the support team who would be happy to help.

 

Kind regards,

Daniel

[GRitchie]

Going to combo all this. Thanks guys.

Quick one - I've enabled the Bitlocker stuff on a test OU, but when right clicking the USB in Windows 7, the 'Turn on Bitlocker' option in the context menu isn't there?

Ideas?

[ITGuyWestMidlands]

Are you using Windows 7 Enterprise? Can you access it via control panel the bitlocker encryption?

[GRitchie]

Nope - as I posted this I googled, to find that Professional (the version we're on) doesn't support it.

I think I can encrypt them on my Windows 10 machine though and then they should be fine.

 

Testing that now!