USB storage - prevent users

[Paid_Peanuts]

I have been asked this morning by our Head to look into a solution to prevent access to USB storage devices for staff only.

 

We currently issue all our teaching staff with laptops so a solution has to work on these laptops when they are off the domain and logged on at home for example.

Also a solution has to work if a staff member logs onto any one of the student pc's/laptops.

 

At current we are a vanilla 2003 network with all XP clients. During the summer the DC's are to move to 2008 R2 with Windows 7 everywhere. I understand with 2008 R2 you can deny access / install to the GUID that you specify. Unfortunately this only works with 7 clients - is this right? In which case a solution like this won't work for us until September when we return.

 

If anyone could shed any light on what solution they think might be best it would be most appreciated!

I don’t have a lot of money to spend on this so preferably the cheaper the better - however it needs to do the job. We have in the region of 1050 clients so paying for software/clients could get expensive.

[glensc]

I have been asked this morning by our Head to look into a solution to prevent access to USB storage devices for staff only.

 

We currently issue all our teaching staff with laptops so a solution has to work on these laptops when they are off the domain and logged on at home for example.

Also a solution has to work if a staff member logs onto any one of the student pc's/laptops.

 

At current we are a vanilla 2003 network with all XP clients. During the summer the DC's are to move to 2008 R2 with Windows 7 everywhere. I understand with 2008 R2 you can deny access / install to the GUID that you specify. Unfortunately this only works with 7 clients - is this right? In which case a solution like this won't work for us until September when we return.

 

If anyone could shed any light on what solution they think might be best it would be most appreciated!

I don’t have a lot of money to spend on this so preferably the cheaper the better - however it needs to do the job. We have in the region of 1050 clients so paying for software/clients could get expensive.

 

I think you need to ask your head what they are trying to acheive with this, as it looks like they are giving you a lot of work to do but it would be a so easy to circumvent it's probably pointless.

 

If it's to secure data the staff could just upload to the internet ( or a local intranet share) and download on a different machine and from there dump to a USB device ( let alone possibly burn straight to CD/DVD from the laptop )

[powdarrmonkey]

This sounds a bit like a fire-fighting solution, have you had an incident lately?

 

It needs to be much more comprehensive, simply removing access to devices for one group of users will only move the problem elsewhere. (As usual, it's much more a cultural problem than a technical one.) Transparent disk encryption might be a better move perhaps?