Students denied access to usb

[witch]

I'm sure this is an easily answered question.

My server is currently set up so that students cannot access anything plugged into a USB. The item is installed and you can see the folders but get an 'access denied' if you try to click.

This is a pain as we have video cameras that the children are using for various projects but currently they cant access their films etc, a staff member has to sort it out and put the files on a shared area.

Can someone tell me where this setting will be? And if I sort it out, I would like to deny the students the possibility of running any .exes off their usb sticks.

 

I found the bit under computer configuration - \User Configuration\Policies\Administrative Templates\System\Removable Storage Access but it is not configured so I dont think this is where the restriction is coming from.

Staff can use usb so there must be something different somewhere!

Edited July 3, 2012 by witch

[SYNACK]

Can you run RSoP snapin in mmc to see all the applied settings then filter it by the term usb

[AngryTechnician]

Have you run RSoP on an affected workstation and user to see if its hidden in another policy somewhere?

 

Edit: What he said ^

[Iain.Faulkner]

Hi Witch,

 

Don't know if any use of not, but we do USB blocking through our AV.

[witch]

Definitely not done that way here. I just cant see where it is done. We have separate staff and student gpos and logic would say that that would be where to find the restriction, but apparently not!

[witch]

Have you run RSoP on an affected workstation and user to see if its hidden in another policy somewhere?

 

Edit: What he said ^

 

What is that? Where do I find it?

 

(it's done by user, not computer, definitely)

[Steve21]

What is that? Where do I find it?

 

rsop.msc (Run it from start menu, or go and add it as a snapin to normal management msc)

 

Steve

[witch]

rsop.msc (Run it from start menu, or go and add it as a snapin to normal management msc)

 

Steve

Sorry, no clue..I have added it I think. Now what? Start menu on what?

Edited July 3, 2012 by witch

[Steve21]

Sorry, no clue...How do I add it? Run it from start menu where?

 

Start box thingy, Run box (Or "Run button" if XP I guess)

 

Either rsop.msc to go straight to it, or mmc to get to management console, then add the snapin.

 

Steve

[witch]

I have added it but now it is asking where to save it - and the technet doc I am following doesnt mention that - help?

 

And if I try to run it I get an RSP server not available error

Edited July 3, 2012 by witch

[Steve21]

You shouldn't need to save it, that's only saving the layout in MMC. If you right click the rsop, and generate data, you can pick the user it'll run under (those who have logged onto it before), and it'll list the policies that applied to them.

 

Steve

[witch]

If I run it from the computer it only gives me the settings for the current user. What am I missing? I need to see the student settings Edited July 3, 2012 by witch

[SYNACK]

Run it on a client, when you generate data you can pick the user to generate it for, as long as a student has logged on to the machine before they should be on the list.

[witch]

What list? When I type it in to a computer, I get a window giving me the username - which is me and not a student, and then it resolves into what looks like the standard "edit" screen you get when looking at a policy - Computer config, user config and all this. I am obviously doing something wrong but I cant see what

[SYNACK]

new plan, 2008r2 also has gpo modelling, its an option in the group policy management snapin, this should let you pick a user and machine to test for.

[witch]

new plan, 2008r2 also has gpo modelling, its an option in the group policy management snapin, this should let you pick a user and machine to test for.

I'm having enough problem with the old plan!

What now? Where?

[witch]

OK. Another tack.

Might be permissions set on the usb denying access to students. Where would that be then?

[pete]

@witch

 

If these are XP clients, check to see that c:\Windows\inf\usbstor.inf (and usbstor.pnf) exist. If it does, ensure that there isn't a deny acl on them.

Edited July 3, 2012 by pete

[sonofsanta]

Resultant Set of Policy (it's a very handy thing to know, so worth perservering with here)

* Log on to a computer that has had the problem as administrator

* Open your Run prompt from the start menu or with windowsKey + R

* type mmc and press enter

* Go to the File menu and choose Add/Remove snap in

* Click the Add button at the bottom

* Scroll down the list and find Resultant Set of Policy, select it, click the Add button

* Click Close

* Click OK

* Right click the Resultant Set of Policy in the left-hand pane and choose to Generate RSoP Data

* Click Next at the Welcome screen, Next past the logging/planning mode screen (it only lets me choose Logging mode here anyway)

* Click Next when it says This Computer

* Click the "Another User" radio button and pick out a username having the issue (it will only list the usernames of people who have logged on at this machine). Click Next.

* Untick "gather extended error info" and and click Next

* Click Finish when it's done

 

You then get something that looks very much like the Group Policy editor but only shows those settings that have been configured. Expand the tree on the left as normal and when you are looking at a group policy folder (e.g. Admin Templates > System > Logon, whatever) it will use the right pane to show you those settings that are configured, what they are configured to, and which GPO the setting is derived from. If you double click any setting you can look at the Precedence tab and see if two or more GPOs are fighting over the same setting and which one is winning.

 

It's still a case of trawling through looking for likely settings, but it narrows the search down only to those settings that are relevant and tells you where you can find the setting and change it.

 

Hope that helps (and that no-one has beaten me to typing this out while I've been writing it up)

Edited July 3, 2012 by sonofsanta

[witch]

windows key + R is disabled as well as the run command when logged in as a user

When I do this as admin I don't get the option to choose another user-??

Thanks for the info though, I will save it for future reference

 

 

*all users are Windows 7

Edited July 3, 2012 by witch

[sonofsanta]

windows key + R is disabled as well as the run command when logged in as a user

When I do this as admin I don't get the option to choose another user-??

Thanks for the info though, I will save it for future reference

 

A quick test here seems to suggest that if I run RSOP from my machine, I can select another computer and then choose from the list of users that have been logged on at that machine, so give it a go from your workstation and it might let you select the right combination.

 

You can also run it in your Active Directory console - right click on the computer or user in AD, go down to All Tasks and choose Resultant Set of Policy - Logging. It should be the same as above from there on out.

[witch]

Just tried it on an IT suite machine rather than a netbook and got the option this time.

However, nothing visible so I am leaning towards permissions on the drive -anyone know where this might be??

[sonofsanta]

I can't think there'd be permissions on the drives themselves, as they're likely to be formatted with FAT32 rather than NTFS so are technically incapable of supporting security permissions.

 

So I'm out of ideas as we don't block storage here. Sorry

[old_n07]

Have a look at this link and see it any of the methods outlined have been implimented, especially points 2 and 3 in the how to as that could restrict students and not staff depending on the permissions set

 

How to disable USB sticks and limit access to USB storage devices on Windows systems | Diary Products - Hannes Schmidt

[witch]

Nope, nothing implemented.

This is driving me mad

What is stopping the usb access??