Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to forbid all users except administrators to write into DVD/CD/USB drives on Windows XP.

Googled around and there is a way to disable devices completely:


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom\Start (from 1 to 4)


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Start (from 3 to 4)

but I need to disable them only for particular users.

share|improve this question

At work we use a product called Sancturary which can do this sort of thing. I have no idea how much it costs, I'm sure there are other products available as well.

share|improve this answer
Thank you for this information. – alex2k8 Mar 14 '10 at 1:03

Check out this article for disabling access using group policy:

share|improve this answer
Thank you for this article. But thought the custom template for group policy is a more elegant solution, it still does the same registry keys editing. As so will disable devices for all users. – alex2k8 Mar 15 '10 at 1:35
I assumed, apparently incorrectly, that since you were posting on ServerFault that the computers in question were part of an Active Directory domain, in which case the group policy could be assigned per user. – user17642 Mar 15 '10 at 16:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.