Disable USB disks

[ajbritton]

I just found this article on the excellent Daniel Petri website. I've not tried it, but it looks a lot simpler than some solutions I've seen.

[Gatt]

nice, pity our school is letting kids use pen drives - much to my disdain

[ChrisH]

Thats how you can stop everyone from using USB disks but unfortunately its per machine. I restrict drives for students as they are always drive d: it's easy for me to do.

[NetworkGeezer]

Why do you need to ban USB drives?

 

So long as you have AV, WSUS,SRP and LUA then there shouldn't really be a problem with executable content.

Locking the BIOS will also help some, despite Geoff's handy cracking tips.

(They have to be able to run the executable first )

[Ric_]

@NetworkGeezer: Why do you need to allow their use? There are many means of electronic data transfer that negates their use and are far more reliable.

 

Surely, the hassle of setting up policies, etc. can be avoided by just not using them.

[tosca925]

We let our kids use them as well.

[Gatt]

they become a haven for kids to bring all sorts in with them - games, viruses, shortcuts etc.

 

I've used GPO to restrict the running of exe's from the pen drives as best i can, but the buggers still get round it.

 

Would rather vito them completely

 

Looking at removing all removable drives from the PC's over summer (ie floppy's and CD/DVD drives, etc)

[ChrisH]

We have that setup and it works ok for us. They can email stuff in if needed or if they cant they can bring it to me to sort on a disc.

[Gatt]

That's how I wanna go, but TPTB are over-ruling me on it

[NetworkGeezer]

Then they have a valid reason for being on Hotmail during lesson time.

[pete]

We don't allow USB drives used by the kids, for the reasons mentioned and it's far too easy to get up to stuff using one. Kids bring anything they need to via sneakernet (and we stick it on) or email it in. We don't have floppy drives or cd-roms for the same reason.

 

We alter permissions on usbstor.inf on the virgin ghost. Works fine for us (yes there are ways around it, but the bar is sufficiently high to make it easier to bring the stick to us).

 

You can also set up a group policy to encrypt the data on all removable media.

[NetworkGeezer]

I've used GPO to restrict the running of exe's from the pen drives as best i can, but the buggers still get round it.

 

How?

 

If you have path based white-list software restriction policies and all students are restricted users then there should be very little they could do.

 

It might take a while but locking the box down is the best policy so you're not caught on the hop. Not every one has broadband at home and the time to wait while the 25MB Publisher file is upload to their Hotmail account.

 

I hope I am not living under a false sense of security.

[Gatt]

They renamed the file IIRC - hadn't locked it down properly in SRP

[ajbritton]

@NetworkGeezer: Why do you need to allow their use? There are many means of electronic data transfer that negates their use and are far more reliable.

 

The only good reasons I can currently think of are where students are working on projects which are too large to move around by email e.g. digital video

[Ric_]

@NetworkGeezer: Why do you need to allow their use? There are many means of electronic data transfer that negates their use and are far more reliable.

 

The only good reasons I can currently think of are where students are working on projects which are too large to move around by email e.g. digital video

 

Which is why I copy the file into their MyDocuments for them or a staff member drops it into the shared area where they can pick it up.

 

FYI I have also blocked access to webmail for kids so that they must email to their school email account which can be monitored more closely. This is mainly for anti-bullying and the like but helps solve this problem.

[ajbritton]

Which is why I copy the file into their MyDocuments for them or a staff member drops it into the shared area where they can pick it up.

 

I guess having Citrix leaves you with plenty of time on your hands

[Ric_]

It's all that walking that I don't do

 

I don't get a lot of people coming to have stuff copied. They generally email it in - like I tell them... it's more reliable. Still get the odd fool with a floppy disk that they have had in the bottom of their bag for 2 weeks... like it's going to work!

[NetworkGeezer]

Ah ..BOFH we meet at last

[Michael]

The solution I use (which has worked perfectly) is to modify the System.adm file by restricting the number of available drive letters. Very simple and works really well.

 

Save a copy of the System.adm file to your desktop and rename it to SystemStaff.adm or SystemPupil.adm for example. Open the file using Notepad. Now click on Edit > Find and type drives. You're now at the right place!

 

POLICY !!NoDrives

#if version >= 4

SUPPORTED !!SUPPORTED_Win2k

#endif

 

EXPLAIN !!NoDrives_Help

PART !!NoDrivesDropdown DROPDOWNLIST NOSORT REQUIRED

VALUENAME "NoDrives"

ITEMLIST

NAME !!ABOnly VALUE NUMERIC 3

NAME !!COnly VALUE NUMERIC 4

NAME !!DOnly VALUE NUMERIC 8

NAME !!ABConly VALUE NUMERIC 7

NAME !!ABCDOnly VALUE NUMERIC 15

NAME !!ALLDrives VALUE NUMERIC 67108863 DEFAULT

; low 26 bits on (1 bit per drive)

NAME !!RestNoDrives VALUE NUMERIC 0

END ITEMLIST

END PART

END POLICY

 

POLICY !!NoViewOnDrive

#if version >= 4

SUPPORTED !!SUPPORTED_Win2k

#endif

 

EXPLAIN !!NoViewOnDrive_Help

PART !!NoDrivesDropdown DROPDOWNLIST NOSORT REQUIRED

VALUENAME "NoViewOnDrive"

ITEMLIST

NAME !!ABOnly VALUE NUMERIC 3

NAME !!COnly VALUE NUMERIC 4

NAME !!DOnly VALUE NUMERIC 8

NAME !!ABConly VALUE NUMERIC 7

NAME !!ABCDOnly VALUE NUMERIC 15

NAME !!ALLDrives VALUE NUMERIC 67108863 DEFAULT

; low 26 bits on (1 bit per drive)

NAME !!RestNoDrives VALUE NUMERIC 0

END ITEMLIST

END PART

END POLICY

 

Under where it says "!!ALLDrives" under both sections enter:

 

NAME !!PupilDrives VALUE NUMERIC 48

 

My above example would block access to drive letters "E" and "F" as 16 + 32 = 48

 

A 1

B 2

C 4

D 8

E 16

F 32

G 64

H 128 etc etc

 

Now click on Edit > Find and type Strings. You're now at the right place! Under ABOnly="Restrict A and B drives only" enter a new line PupilDrives="Pupils have no flash drives". Now save your file.

 

Once you've uploaded your modified adm file, within Group Policy navigate to:

 

User Config > Admin Templates > Windows Components > Windows Explorer

 

Look for two policies called:

 

"Hide these specified drives in My Computer" And "Prevent access to drives from My Computer".

 

Enable both these policies and select your custom policy from the list. Logon to a workstation and test your modification

 

The great thing about this solution is that it isn't a machine restriction, but a restriction based on user. So at my school, staff can happily use flash memory sticks on any computer, however if a child attempted to, Windows would do nothing!

[MkII]

A new piece of s/w on this theme: http://www.intelliadmin.com/blog/2006/06/disable-usb-drives-remotely.html

 

Remote USB Dive Disabler

[ChrisH]

I bet it just unregisters the usbstore.sys Still nice interface

[MkII]

Correct!

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

 

DWORD value name: Start

 

Value data: 4 = USB storage devices are disabled

 

Value data: 3 = USB storage devices are enabled

[eejit]

Correct!

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

 

DWORD value name: Start

 

Value data: 4 = USB storage devices are disabled

 

Value data: 3 = USB storage devices are enabled

 

I've made a script to change that value to 4, but the buggers are still able to use the drives. How is that possible?

 

(BTW, I have to checked the registry to make sure that the settings did get applied properly)

 

[mac_shinobi]

disable usb in the bios ? But then you wont be able to use USB keyboard or mouse afaik, unless your bios's can stop just memory sticks ( Not sure if thats possible though, although it would be nice )

[Anddy]

Of course, disabling in bios is not the way to go. What about usb mice and keyboards?

You can handle this with special protection tools. Another approach is to use a desktop management utility, for example Desktop Authority. As far as I know, this tool contains a usb security option for restricting the use of usb storage devices and and any communication devices.