UNCLASSIFIED DISABLING USB STORAGE DEVICES THROUGH GROUP POLICY

Transcription

1 DISABLING USB STORAGE DEVICES THROUGH GROUP POLICY 1. Logon to Domain Controller 1 (DC01) 2. Open Admin Tools 3. Navigate to the Workstations OU 4. Right click and select New Organizational Unit See Figure Name the OU USB Authorized and select OK See Figure Disable Group Policy Inheritance on the USB Authorized OU by right clicking on the OU and selecting properties and then selecting the Group Policy Tab. If you do not see the checkbox for blocking group policy inheritance and you see the Open button select it and then right click on the USB Authorized OU in the Group Policy Management Console and select block in heritance. See Figure 3 & 4 7. Assign the Workstations and GPOs to the USB Authorized OU by right clicking on the USB Authorized OU in the Group Policy Management Console and selecting link an existing GPO. Select the Workstations Policy and any other policy you have applied to the Workstations OU. See Figure Create USB Restriction Administrative Template files Copy the following text into notepad and save it as removablestorage.adm in the directory C:\WINNT\inf\ CLASS MACHINE CATEGORY Removeable Storage Write Access POLICY USB Write Access KEYNAME SYSTEM\CurrentControlSet\Control\StorageDevicePolicies VALUENAME WriteProtect VALUEON NUMERIC 1 VALUEOFF NUMERIC 0 END POLICY POLICY Disable Installed USB Storage Devices KEYNAME SYSTEM\CurrentControlSet\Services\USBSTOR VALUENAME Start VALUEON NUMERIC 4 VALUEOFF NUMERIC 3 END POLICY END CATEGORY; 9. Create USB Restriction GPO in the Group Policy Management Console by right clicking on the Group Policy Objects OU and selecting New. See Figure Name the Group Policy Restrict USB Storage Devices and select OK. See Figure Right click on the Restrict USB Storage Devices GPO you just created and select edit.

2 12. On the Group Policy window right click on Restrict USB Storage Devices and select Properties. See Figure Check the checkbox Disable User Configuration settings and then select OK. See Figure Right click on the Administrative Templates folder in the Group Policy window and select Add/Remove Templates. See Figure Select Add and then navigate to the C:\WINNT\inf\ and select removablestorage.adm 16. You should now see removablestorage Select Close. 17. In the Group Policy Window select Administrative Templates if not selected and then right click and select View and then select Filtering. See Figure Uncheck Only show policy setting that can be fully managed. Select OK See Figure Navigate to Administrative Template Removable Storage Write Access 20. Ensure USB Write Access is set to Not Configured and Disable Installed USB Storage Devices is set to Enabled See Figure Close the Group Policy Window 22. In the Group Policy Management Console, right click on the COMPOSE Workstations OU and select Link an Existing GPO, then select Restrict USB Storage Devices. See Figure 14. Enabling USB Storage for Authorized External Storage Devices 1. Any computers you would like to enable the USB Storage Device for you must now put in the USB Authorized OU in Active Directory. 2. After that you must re-enable the USB Storage Device Support by changing the registry DWORD value from a 4(USB Disabled) to 3(USB Enabled). The registry value is found at the following location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\

3 Figure 1.

4 Figure 2.

5 Figure 3.

6 Figure 4.

7 Figure 5.

8 Figure 6.

9 Figure 7. Figure 8.

10 Figure 9. Figure 10.

11 Figure 11.

12 Figure 12.

13 Figure 13.

14 Figure 14.