[ltsb, 1607] Disable USB GPO by user not working?

[Garacesh]

There's been a few.. Problem students recently with inappropriate files. I've come to the conclusion that they're coming in on memory sticks.

 

I've created a new policy, headed to User Configuration/Policies/Administrative Templates/System/Removable Storage Access and enabled All Removable Storage classes: Deny all access

Is it working?

Nah, that'd be too easy!

 

So, just to cover my bases, I've also enabled:

CD and DVD: Deny read access

CD and DVD: Deny write access

Floppy Drives: Deny read access

Floppy Drives: Deny write access

Removable Disks: Deny read access

Removable Disks: Deny write access

Tap Drives: Deny read access

Tape Drives: Deny write access

WPD Devices: Deny read access

WPD Devices: Deny write access

 

Every bit of information online says that these are the right policies to enable

Still not working.

 

I've looked through the other policies, there's no contesting policies.

I've even set the policy to enforced, just to be safe. Still doesn't work.

[Garacesh]

Oh look. Whodathunkit?!

 

When you actually apply the policy to the user.. it works!

 

My test user was in the wrong OU.

Let this thread stand forever as a testament to my shame.