USB Blacklist

[jmcewen]

I've been having a problem with students passing round USB drives with content we don't want them using (flash games / music / etc.)

 

is there anyway of creating or using a blacklist to stop certain USB devices being accessed on the network, i can see a lot of whitelist solutions but that's not really what i'm after.

[LeMarchand]

I've been having a problem with students passing round USB drives with content we don't want them using (flash games / music / etc.)

 

is there anyway of creating or using a blacklist to stop certain USB devices being accessed on the network, i can see a lot of whitelist solutions but that's not really what i'm after.

 

Can't you block all spare drive letters for students? (They'll then just host them in cloud storage, but I guess that you can use your firewall to block those sites).

[jmcewen]

We're trying not to do a blanket ban unfortunately, just stop certain offending devices being allowed onto the network

[LeMarchand]

We're trying not to do a blanket ban unfortunately, just stop certain offending devices being allowed onto the network

 

How are you identifying the "offending" devices?

[jmcewen]

Mostly through catching students doing things they shouldn't be doing via Impero

[Mozzy12]

I deploy a little tool called USBDLM to manage what drive letters are assigned to any connected USB devices, then can control what can run from these drives through GPO using software restriction policy. Not sure if this will accomplish what you need but light be worth a look.

[LeMarchand]

Mostly through catching students doing things they shouldn't be doing via Impero

 

If you have to catch them first, you could use a GPO that applies only to the sinners: Administrative Templates > System > Removable Storage Access > Removable Disks and deny read access. Obviously this prevents them using any USB device, but if you did find a way just to ban a specific one surely they'll just use a different one?

 

I may be totally misunderstanding the problem!

[jmcewen]

That was pretty much what i was after, but if we did a blanket ban we'd be getting complaints from teachers that students cant access their work!

[LeMarchand]

That was pretty much what i was after, but if we did a blanket ban we'd be getting complaints from teachers that students cant access their work!

 

Give it a go - not had to use it myself, but seems like it should be the answer. Just stick the policy in to cover the student OU(s) but only have it applying to those who have been caught out.

[Sheridan]

We have a blanket ban on USB devices for students. Students can store their work in their google drive and should use that, if they *really* have to bring a USB pen in either we or the teaching staff can copy stuff into their work folder for them.

[Sagima]

I seem to remember being shown sophos device control in their av could do that. I don't have it to check though.

[fiza]

I seem to remember being shown sophos device control in their av could do that. I don't have it to check though.

 

Can confirm that Sophos AV device control can do this via the Enterprise Console.