Microbits\usb blocking

[ptotham]

I am looking for some advise as i dont think this is going to be possible to do, the school I am working in has RM cc4 () and uses microbits to teach students programing\coding but as it stands there is no policy to stop students bringing usb pen drives in from home, I am looking for a way of blocking usb pen drives at machine level but need to make sure that microbits carry on work but the microbit appears as a usb mass storage device which rules out using group policy i think.

 

any advise would be great?

 

Cheers

[localzuk]

It depends how thorough you wish to be. There's the GPO way of doing it - use the Device ID in a whitelist - https://technet.microsoft.com/en-us/library/cc731387.aspx?f=255&MSPPError=-2147217396

 

Or there's third party software ways of doing it such as MyUSBOnly - MyUSBOnly: USB Control Software,USB Security,Device Control,Endpoint Security,Block USB Port :

[ptotham]

thanks for the feed back localzuk I looked at the group policy device id white list but usb device dont have there own individual ID so if a student bought a usb that was the same make and model as a staff members they would be able to access the device, the joy of having a RM network can't have individual OU for student machines and staff. thanks for the link to the Myusbonly Il pass that on to the budget controllers.

[localzuk]

thanks for the feed back localzuk I looked at the group policy device id white list but usb device dont have there own individual ID so if a student bought a usb that was the same make and model as a staff members they would be able to access the device, the joy of having a RM network can't have individual OU for student machines and staff. thanks for the link to the Myusbonly Il pass that on to the budget controllers.

The Microbit will have a device ID though - and its unlikely that'll have the same ID as a generic memory stick. You should be able to apply the GPO by user I believe, rather than by device.

[caffrey]

USBDLM is free and I think it can do what you want - see white / blacklisting here USBDLM Help Not sure how this will work in a RM environment though

[ptotham]

The Microbit will have a device ID though - and its unlikely that'll have the same ID as a generic memory stick. You should be able to apply the GPO by user I believe, rather than by device.

 

the microbit work perfectly, but when i compared 2 use of the same manufacturer they both had the same hardware ID, so if i allowed it through for staff then if a student bought in the same manufacturer they would be able to access it as well. it is a computer policy so cant run it for users.

[ptotham]

USBDLM is free and I think it can do what you want - see white / blacklisting here USBDLM Help Not sure how this will work in a RM environment though

 

thanks caffrey, i will take a look.

[localzuk]

the microbit work perfectly, but when i compared 2 use of the same manufacturer they both had the same hardware ID, so if i allowed it through for staff then if a student bought in the same manufacturer they would be able to access it as well. it is a computer policy so cant run it for users.

It is definitely also available as a User policy - User Configuration\Policies\Administrative Templates\System\Removable Storage Access.

[DrCheese]

Do you have Sophos? That has USB blocking in it & we just whitelist the microbit device ID