How to enable USB/SD etc for students

[witch]

I must be missing something but I cant see what. I have been asked to enable the usb and sd card facility for students but for the life of me I cant find the policy that has disabled it!

Currently staff can access removeable storage but students cannot.

So my thinking is that the disabling must happen in a policy that only applies to the students.

 

We have a 'students' policy that is the only one directly applied to student users but it isnt in there. All other policies are applied to either more than one group of people, or to computers.

Any ideas where else I could be looking?

[VeryPC_Tom_M]

I'd try looking in

 

Computer Configuration - Administrative Templates - System - Removable Storage Access

 

and

 

Computer Configuration - Administrative Templates - System - Device Installation - Device Installation Restriction

 

They're the locations which pop into mind when restricting access to removable storage.

[witch]

Thanks, but it cant be in Computer Configuration, it has to be User, doesnt it? Staff can access drives wherever they are.

I was looking in removeable storage access.

 

I have had a look at installation and nothing is configured anyway.

No drives are hidden anywhere either

[witch]

Someone must know. I have looked through every single policy (clutching at straws, here) and nowhere is access to removeable storage disabled. So it is somewhere else?

As I said, Staff can access such things but students cant.

 

There is something I am missing - but what?

[SYNACK]

Could it be in the AV software, I know that some can happily block user access to all sorts of stuff based on the group.

 

I'd also do an RSoP for a student and a teacher then have a compare (or use GPO modelling in the group policy management thing in 2008 R2 which is probably easier).

[pete]

Loopback policy on the OU triggered by security group membership? (filter policy by security group - if you're a kid it applies, if staff it doesn't?)

 

What does Group Policy modelling show?

 

GPMC > Group Policy Modeling (second from bottom) - model against a kid on randomcomputer01, then against a member of staff on randomcomputer02 and compare.

 

You can also do stuff with device drivers and security groups (well, on XP at least you can).

[MYK-IT]

Are you using USBDLM to control devices/ports?

[Ergo]

Could it be simply that you have drive letters hidden for students which includes the drive letters which would be used by the removable devices? Off the top of my head I could not direct you to the policies, but something like:

 

User -> Policies -> Windows -> Explorer -> Hide all drive letters except...

 

David Irwin

[witch]

Drive letters not hidden - well, only the C drive as you would expect

Definitely not the antivirus

Dont know if I am using USBDLM - how do I tell?

Will look at Group Policy Modelling tomorrow

The machines are all windows 7 and this has only occurred siince we had our new server just before the summer break, so I KNOW it is something on there...somewhere...

The thing is that for the policy to apply to some groups and not others, the "disable" setting must be somewhere and I cannot find it.

[witch]

I have modelled a random child and a random staff member and can see no differences with respect to accessing USB drives etc. So, as I thought, it looks like it isnt done by group policy.

What else can I look at?

I need this sorted quickly because the staff are getting around it by logging on all the netbooks as staff so that the children can access the SD card. Obviously this is not good as the children can then access all sorts of things they shouldnt be able to , not forgetting profile corruption issues etc

[pete]

I have modelled a random child and a random staff member and can see no differences with respect to accessing USB drives etc. So, as I thought, it looks like it isnt done by group policy.

What else can I look at?

I need this sorted quickly because the staff are getting around it by logging on all the netbooks as staff so that the children can access the SD card. Obviously this is not good as the children can then access all sorts of things they shouldnt be able to , not forgetting profile corruption issues etc

 

What does the event log say when a removable device is plugged in by a kid?

[Mcshammer_dj]

are you using sophos

[witch]

No Sophos - NOD32 here

[witch]

Nothing happens when a child plugs in a USB.

Can anyone think of anything else I could look at? Getting a bit desperate here!

[SYNACK]

login as a teacher, plug in a usb key then log off and back in as a student to see if it keeps it mapped.

 

Boot with USB in then logon as student to see if it shows up

 

Check in drive manager as a student to see if the drive exists when plugged in as a student.

[LeMarchand]

It's a long shot, but you're not using Ranger, are you?

[witch]

Nope - Vanilla Server 2008R2

[witch]

login as a teacher, plug in a usb key then log off and back in as a student to see if it keeps it mapped..

No it doesn't

 

 

 

Boot with USB in then logon as student to see if it shows up.

No it doesn't

 

 

 

Check in drive manager as a student to see if the drive exists when plugged in as a student.

Not sure what you mean - nothing happens - no noise or recognition that something has been plugged in

[SYNACK]

You don't have intel device security tools installed or anything like that do you, that can block out USB.

 

Do the stations recognise if something else like a printer is plugged in

 

can you drop a test student account in the staff OU, leaving all the groups the same and see if this works?

[witch]

You don't have intel device security tools installed or anything like that do you, that can block out USB.

 

Do the stations recognise if something else like a printer is plugged in

 

can you drop a test student account in the staff OU, leaving all the groups the same and see if this works?

Nothing installed of that sort

Will check and see if computers see a printer when logged on as student.

Will move a test student too.