Computer GPO with User Delegation

[TSEARS]

Hi, I wonder if someone can help...

 

We have been trying to have a computer policy which is only applied to certain users, i'm sure it not possible but thought i'd ask anyway.

 

We are trying to lock down computers so USB sticks can only be used by staff that are protected via BitLocker. but we want it so students can use memory sticks without protection. Its a computer policy so I know the simplest solution would be to set it at the top of the staff computer OU and apply it down the tree, but if staff find out they can user non-protected memory sticks on student computers it kind of ruins the idea.

 

We have tried the delegation, by giving students "deny" permissions but no luck, we have also tried enabling loopback but no luck either.

 

Its the head of ICT that wants to apply this, so may have to say its for everyone or no-one!

 

Cheers,

Tom

[TSEARS]

also, forgot to mention - I have been looking at mbam gpo settings, but not sure weather this would have the options to do so

[ReadTheNetwork]

Not sure, but this doesn't sound like it's possible in GPO. Anything in your AV endpoint protection which would allow you to do this? Or something similar.

You're probably aware but computer settings is set for the machine (i.e. everyone).

 

1) I would look at running a script when a USB stick is plugged in. windows - Starting scheduled task by detecting connection of USB device - Super User

 

2) Script can detect it as a bitlocked USB https://technet.microsoft.com/en-us/library/dd875560(WS.10).aspx

 

3) Then run a script to disable the USB port if not.

 

There is probably be an easier way.

[fiza]

We had the same issue but having spoken to SLT we decided to implement it across the board for staff and student machines. Students and staff can still use usb drives as 'read only' but they have to be bitlockered if they want to take anything off the system. We encourage students to use Google Drive as we have GAfE. If any students need to take large files off the system (photography or CDT stuff) then we will do it for them if they bring us the usb drive.

[Arthur]

This might help?

 

www.edugeek.net/forums/windows-7/153652-bitlocker-usb-encryption-per-user.html#post1317678

[glen_j]

Another option would be to enable the policy for staff computers via gpo and then prevent staff users logging onto student computers via the log on locally right also stops the kids guessing teachers passwords and accessing things they shouldn't

[TSEARS]

Thanks for all the feedback and suggestions everyone! I have been looking at scripts, but locking down student pc's could be a good idea!