Group Policy Not Re-Enabling USB Drives for a User?

[JRA]

Hi everyone - seem to have a sticky one...

 

Put in policy to block USB devices for staff. One user does 100% need removable disks, so just thought I'd add a deny into the Apply group policy permissions from the delegation tab. No joy though.

 

Even added downstream a policy that applies solely to them to enable USB drives but no joy at all, still inaccessible.

 

Anyone ever seen this one and un-picked it?

 

Thanks for any help if you got any!

[Mako]

Which policy are you editing to achieve this effect? User Config > Policies > Admin Templates > Windows Components > File Explorer > Prevent Access to Drives ?

 

What happens if you run an RSOP against the user?

[JRA]

Hi - no set this one as user policy; User > Policies > Admin Templates > System > Removable Storage

 

RSOP kinda just doesn't have any of those settings at all in the "system" folder where I'd expect them.

 

EDIT - for clarity though, another MoS account logging in will display what I'd expect in the System folder for RSOP. So I guess demonstrates my downstream policy is actually applying for all the good that's doing, it's just not "actually working." :/

Edited June 14, 2021 by JRA

[JRA]

Okay think I have it.

 

For these (and probably other) settings, they need specifically re-enabling after any given policy disables them. So in order to put in a policy to do so you'd (I guess) have to keep the MoS you don't want to get restricted in a special OU for it and apply the policy there OR (as I've done) tried to alter the permissions in the delegation tab of the policy.

 

If going the second route, make sure the group Authenticated Users is still there (I binned it) AND just give them "read" and not "apply" along with it. Then put your separate MoS in to "apply" that policy, then you're good.

 

EDIT - Also mark the policy as enforced too!

 

It's gone 6 so I'm off to the chippy.

Edited June 14, 2021 by JRA