Block USB Storage Devices but Allow Cameras and SD card readers.... how?

[Silica]

The school plans to block all USB storage devices soon, but students will still need to be able to transfer files from DSLRs and SD cards.

 

Is there a solution for doing this without teaching wanting to murder me?

 

We have NetSupport DNA

 

Thanks

[TriggerHappyUK]

 

Is there a solution for doing this without teaching wanting to murder me?

 

 

Buy PCI Card readers for your computers

 

Similar to this:

 

https://www.aliexpress.com/item/32972613380.html?spm=2114.search0302.3.227.1a184e09c7eoXf&ws_ab_test=searchweb0_0,searchweb201602_0,searchweb201603_0,ppcSwitch_0&algo_pvid=887aaf9d-93a5-4de0-85b6-5557eacc38f1&algo_expid=887aaf9d-93a5-4de0-85b6-5557eacc38f1-29

Edited September 16, 2019 by TriggerHappyUK

[Garacesh]

We disallow everything except your regular, run-of-the-mill USB devices, so removable storage only, which isn't quite the same as you want but we're considering going down the block-all-of-it route.

We have the same issue with Photography students, as we don't have enough DSLR's a bunch of them use their phones (which count as WPD devices for GPO, which are blocked for pupil accounts)

 

Short of buying card readers that don't operate over USB, my solution is (what I call, no idea if it has a proper name) a selective enforcement policy, which is essentially a GPO that only applies to certain users. It's a pain, but it's done by breaking the standard security permissions so Authenticated Users can only read it (so unticking Apply group policy), then giving 'Read' and 'Apply group policy' to the security group you want it to apply to. Then set the policy to 'Enforced'.

(You could also separate kids into their own OU and apply policies that way, but since we separate our kids by year in AD anyway that'd create a bunch of surplus OU's so I didn't want to do that)

 

We also do this for pupils who have been caught copying pirated stuff from USB's with a deny usb policy. It's not pretty but it works.

 

Once that's in place, all you have to do is add/remove users from the relevant security groups.

 

It will, however, give those kids the capability of accessing any USB storage devices, so regular USB sticks too. You can still deny USB FDD/CDRom though.

 

It's a quick'n'dirty fix, I'm not going to lie, but if you need the kids to access cameras/etc ASAP it'll get you functional until you can find something better.

Edited September 16, 2019 by Garacesh

[FN-GM]

Could you make USB devices read only instead of completely blocking? What way all the card readers will work and guests presenters etc can still read their data from USB.

[jthompson]

Could you make USB devices read only instead of completely blocking? What way all the card readers will work and guests presenters etc can still read their data from USB.

 

This is what we do. Our USB policy is there for data protection, to prevent data leaving school systems insecurely. We don't mind if people are bringing stuff in. The security aspect can be addressed using a whitelist-based SRP or AppLocker policy to prohibit anyone from running anything from removable storage.

[rad]

Why what’s the difference? won’t students just put their files on a SD card instead as that works but USB doesn’t?

[Garacesh]

Why what’s the difference? won’t students just put their files on a SD card instead as that works but USB doesn’t?

 

I thought DSLR's usually used CompactFlash?

[SamanthaD]

Depends on the brand. CF are less common these days, SD is more popular but some brands use xd cards, or 4k video cameras use CFast cards nowadays.

[TechMonkey]

Could you make USB devices read only instead of completely blocking? What way all the card readers will work and guests presenters etc can still read their data from USB.

 

This is the route we went. It isn't perfect but allows staff to bring files in but not take them out. Allows visitors access to their files and allows people to copy photos off camera cards. The only confusion staff had was how to delete or format a card on the camera.

[PlantHead]

Look at your anti virus software and it should do this

Trend/Sophos do for sure.

You can block all removable storage devices and then in the AV software just white list the devices you want to allow.

[Garacesh]

Look at your anti virus software and it should do this

Trend/Sophos do for sure.

You can block all removable storage devices and then in the AV software just white list the devices you want to allow.

 

I wonder if SCCM has an option for this..?