4

I need to disable windows machine in the domain from copying files to one's own portable devices. I found a setting that will tell the registry which will tell the computer to 'writeprotect'(StorageDevicePolicies\WriteProtect) portable storage devices. However, smartphones are found to bypass the setting by presenting itself as a portable media player. How shall I block that too?

Improve this question
1
  • 1
    It seems that there is something called MediaTransferProtocol(MTP) involved.
    – billyswong
    Sep 28, 2012 at 8:01

2 Answers 2

Reset to default
3

Following would block MTP connected device access

Computer Configuration\Administrative Templates\System\Removable Storage Access

WPD Devices - Deny read access - enable

source : http://msdn.microsoft.com/en-us/library/bb530324.aspx

Improve this answer
1
  • FYI: At that time the policy domain was run by Win Server 2003, so this functionality was not available at that time. Servers have been upgraded later on.
    – billyswong
    Jan 29, 2018 at 15:29
1

Can you disable all MTP devices outright? It would break both read and write to those devices, but in a secure environment you may not care. The removable device write protect option is a special case to handle that kind of thing. Apparently it only covers removable block devices.

It would be crude but if you can identify an .inf file or .sys driver file specific to MTP devices and then delete or deny all access (including to SYSTEM which is what the PlugAndPlay service runs under) access to it, the device would not function when plugged into the system.

If you go into device manager, find the device and look in the Details tab under Properties, Inf name will tell you the name of the .inf file that best identified the device. Under Driver -> Driver Details it will list the actual driver binaries loaded to support the device.

Take care to disable an .inf or .sys file specific only to that kind of device, lest you disable something critical. Try it in a VM (make a snapshot first) and make sure it doesn't break anything else.

All things being equal, disabling only the .inf would probably be better than a .sys file. Disabling access through security will probably work better as SFP may just replace the files you delete.

Improve this answer
4
  • The disabling of the inf does work, but apparently not something that can be set in domain policy
    – billyswong
    Dec 11, 2012 at 5:09
  • 1
    You can make a logon script part of a domain policy and have that script delete the .inf
    – Chris Smith
    Dec 11, 2012 at 15:35
  • Thanks for update. I have convinced my boss not messing with system files a couple months ago though. So no need for the script
    – billyswong
    Dec 13, 2012 at 5:58
  • In addition to this, you can audit the registry and delete any devices with MTP in their CompatibleIDs. See gist.github.com/mbrownnycnyc/5118310
    – brandeded
    Mar 8, 2013 at 17:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .