enjay Posted March 7, 2012 Posted March 7, 2012 Anyone know how to do this? I found something on MS which had a .adm file, but that doesn't seem to do anything (or doesn't like being filtered to only apply to specific user groups); some other sites talk about changing permissions on usbstor.sys and usbstor.inf, but I don't see how to do that via GPO (also I think that blocks USB keyboards and mice too, which is no good).
Arthur Posted March 7, 2012 Posted March 7, 2012 doesn't like being filtered to only apply to specific user groups The ADM disables the USBSTOR service, so it would be a per-machine setting.
FN-GM Posted March 7, 2012 Posted March 7, 2012 You could make a logon script to stop the USBSTOR service and then a log off one to start it again.
Arthur Posted March 7, 2012 Posted March 7, 2012 Also worth mentioning... If you disable the ability of the usbstor.sys driver to run on the computer, you will in fact block the computer's means of discovering the flash drive and loading the appropriate driver. This does not disable USB devices that aren't for storage. Note that this will only prevent usage of newly plugged-in USB Removable Drives or flash drives, devices that were plugged-in while this option was not configured will continue to function normally. Also, devices that use the same device or hardware ID (for example, two identical flash drives made by the same manufacturer) will still function if one of them was plugged-in prior to the configuration of this setting. (Source)
MYK-IT Posted March 7, 2012 Posted March 7, 2012 An alternative method would be to use USBDLM combined with an appropriate usbdlm.ini configuration (e.g. no USB Drive Letters) that can be copied across (via script or GPP for example) during logon so this can be user based. You may also have to stop/restart the usbdlm service..not got notes to hand but check out the following: USBDLM Main Website USB Drive Letter Manager - USBDLM USBDLM Configuration Options USB Drive Letter Manager - USBDLM USBDLM Help
enjay Posted March 8, 2012 Author Posted March 8, 2012 So, no simple way of doing this then? Back in CC3 land, I just prevented access to drive letters D-H on the usertype, 10 seconds, job done - anyone know what this actually did, and how I can replicate it on a vanilla network?
strawberry Posted March 8, 2012 Posted March 8, 2012 use usbdlm to assign the drive letter, then use group policy to hide the drive.
enjay Posted March 8, 2012 Author Posted March 8, 2012 use group policy to hide the drive. That's the bit I'm unclear on - how do you do that?
Arthur Posted March 8, 2012 Posted March 8, 2012 HideCalc is one way to do it. It even lets you create ADMX/ADM files. http://i.imgur.com/VQaVF.jpg 3
enjay Posted March 8, 2012 Author Posted March 8, 2012 HideCalc is one way to do it. It even lets you create ADMX/ADM files. Awesome, thank you so much. That does exactly what I was after (funny name, though!)
strawberry Posted March 8, 2012 Posted March 8, 2012 That's the bit I'm unclear on - how do you do that? Ta Da! Using Group Policy Objects to hide specified drives
enjay Posted March 8, 2012 Author Posted March 8, 2012 Thanks Strawberry, I'd missed that. One question though - it can be used to "Restrict A, B, C and D drives", so what happens if someone plugs in two pen drives - wouldn't the second be E: and therefore accessible?
Steve21 Posted March 8, 2012 Posted March 8, 2012 Thanks Strawberry, I'd missed that. One question though - it can be used to "Restrict A, B, C and D drives", so what happens if someone plugs in two pen drives - wouldn't the second be E: and therefore accessible? You can edit the file to add more rules, just means not using the default settings I think. Steve
strawberry Posted March 8, 2012 Posted March 8, 2012 You can select the first 3 extra drives that will be assigned to usb, for instaance k,l and m. You then use GP to block those drives.
enjay Posted March 8, 2012 Author Posted March 8, 2012 You can edit the file to add more rules, just means not using the default settings I think. Yes, it uses numeric values to represent each combination of drive letters, but doesn't suggest how to calculate those values; I think it is actually doing the same thing as HideCalc (linked above) but not in quite such a friendly way.
apeo Posted March 8, 2012 Posted March 8, 2012 Yes, it uses numeric values to represent each combination of drive letters, but doesn't suggest how to calculate those values; I think it is actually doing the same thing as HideCalc (linked above) but not in quite such a friendly way. I dont use HideCalc but it creates the adm for you so you dont have to manually edit one yourself. To answer your question, all you do is add up the values or easier then that just type in the binary value and convert to decimal. Here I edit the WindowsExplorer.admx and WindowsExplorer.adml directly to make the required changes. Note you can not only Hide but there's also a 'Prevent access on drives in My Computer' and i think the adm value for that one is NoViewOnDrives. How do I hide or prevent access to specific drive letters? | Group Pol
jonnykewell1 Posted March 8, 2012 Posted March 8, 2012 got any tutor control software? ab tutor blocks usb devices. Also as mentioned USBDLM is good. we also have sophos anti virus which has a device block feature.
enjay Posted March 8, 2012 Author Posted March 8, 2012 got any tutor control software? ab tutor blocks usb devices. No, but even if we did, I'd want something automatic rather than relying on teachers to disable/enable at the ends of the lessons.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now