I need some help putting together the pieces to do this:
- Run a script or program that disables USB storage devices.
- Log any blocked device mounting to the system event log.
- Run a second script or program (or cancel the running program from step 1) and re-enable USB storage devices.
(My app is run on PCs in public labs to create a restricted access "sandbox" in which a user takes a test. I need to block USB storage devices to prevent cheating)
- My solution will be executed against public computers that I do not have control over. Anything that requires a reboot, modifying the BIOS, or physically altering the computer won't work.
- I can assume that the solution will be executed as an admin, but bonus points if it works for a non-admin.
- Only worried about Windows XP right now. Bonus points for Vista or Win7 compatibility.
Block automatic mounting of devices via KB 823732. Quick and easy, but:
- I don't get notified when a device is blocked. (I want to know if someone even tries to cheat, even if they are blocked)
- According to this article, if the USB Storage driver is not already installed then the Plug-N-Play system will install it on first use, overwriting the registry key and enabling access
Disable USB storage via Group Policy (KB 555324).
- Can I script the application of these policies to the local computer at runtime, without a reboot?
- How easily can I revert the policy to its prior state when I'm done?
- Will blocked devices show up in the security log?
Modify ACLs for USBSTOR.SYS, as shown in this SF question]4.
- If I deny rights to the file for the current class of user, will my revert script be able to grant the rights back?
- If I deny rights to the file, how do I make sure that any device mount attempts are recorded in the security log?
I'm open to solutions in .NET or using batch file or powershell scripts.
(Note: this is related to my similar, bountied Stack Overflow question. If you care about SO rep, feel free to answer there as well)