Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We need a way to prevent users from copying anything to and from USB drives unless they are a system administrator. What can be done to remove this access for security purposes.

share|improve this question
4  
snide answers: (1) seal up all the USB ports with epoxy (2) shoot everyone who's not a sysadmin.... –  Jason S Jun 18 '09 at 19:09
    
@Jeremy E - How will you be able to use your USB Keyboard and Mouse if you disable USB...? –  JFV Jun 18 '09 at 19:18
    
that's not copying filesystem data; keyboards and mice are Human Interface Devices –  Jason S Jun 18 '09 at 19:22
    
@Jason S - Sometimes I have a brain... And others... Well you know... –  JFV Jun 18 '09 at 19:25
add comment

10 Answers

up vote 13 down vote accepted

Microsoft has a knowledge base article on this very issue (KB555324). You have to create a custom Group Policy ADM. O'Reilly has an easier to grok writeup at:

http://windowsdevcenter.com/pub/a/windows/2005/11/15/disabling-usb-storage-with-group-policy.html.

Hope this helps.

share|improve this answer
add comment

MyUSBonly from AC Element Company and StopUSB from EverStrike will also work.

Both of them ask for a password if you want to mount a new, unknown USB device.

To be honest, both could be better designed, but at least they do the job.

share|improve this answer
add comment

If you are working with Windows Vista and above, there are Group Policy options that give you fine grained control over which USB devices are allowed or not allowed. (If you have to support WinXP, see the other answers listed here.)

In Windows Vista or above, go to the group policy editor and drill down to: Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions

There you will find options to white list of black list devices either by specific device IDs or by the class of device. There is also a very important policy at the bottom that allows you to block everything not covered by the other polices.

All you have to know is either the Hardware ID of the device or the Device Class guid. Both of these things can be found in Device Manager if you plug a device into the machine.

Using the policies that are there you could, for example, allows all mice and keyboards, allow a specific model of a USB scanner, and block everything else.

share|improve this answer
add comment

Another option would be to use USBSecure. It's a small deployable script which reads a white list of usb devices from a file share. So you can explicit allow usb storage devices for some users or allow vendor specific devices (e.g. all usb keyboards and mice from logitech). oh, and it's freeware.

share|improve this answer
add comment

i think better solution is DeviseLock software: http://www.devicelock.com/ It is real useful and have huge functional.

share|improve this answer
add comment

All solution are nice, but you need also to think about a process to be able to load data from USB.

I am in a bank at the moment and by default all USB port are lock with a GPO who will not load disk.

Problem is they dont have a process when an external consultant come to load some data, its a real pain to transfer iso file, or any documents, because if you cant plug USB key, also you cant plug laptop on the network.

If you lock all your USB, dont forget you still need sometime a way to load data from USB, and 5GB of data across the web/mail is not always an answer.

Security always come with a price.

share|improve this answer
add comment

GPO will disable the drivers:

http://support.microsoft.com/default.aspx/kb/555324

share|improve this answer
add comment

A quick and dirty fix will be to use a group policy disabling access to usb devices, take a look at the following article. There are also commercial products which can accomplish the same thing, with better grained security.

share|improve this answer
add comment

Epoxy works great

share|improve this answer
    
Seriously, heard of many companies doing this. –  Aaron Weiker Jun 18 '09 at 19:12
    
I think I heard that the NSA or CIA or military did this, can't find a reference to it though. Anyone find an article online? –  Jason S Jun 18 '09 at 19:13
    
Didn't Jason S just say that? –  MathewC Jun 18 '09 at 19:15
    
There are some issues with this approach. Most keyboards and mice are USB based these days. Those ports will remain functional even if you epoxy the devices themselves to the case, and can be used for dark purposes simply by prying the current device out. –  Yannone Jun 18 '09 at 19:18
1  
I've not seen USBs dripping with epoxy. But, in a former life (CERT team), I helped desolder radios/antennas to eliminate wifi security issues in laptops. Fun days. –  dr.pooter Jun 18 '09 at 20:01
show 2 more comments

In Windows, you can disable the USB Storage driver by setting a registry key. This could be configured in a GPO and applied to a limited set of machines. If you want to allow a subset of USB storage devices you will probably have to turn to a third-party product that runs some sort of agent.

share|improve this answer
add comment

protected by Michael Hampton Feb 19 '13 at 15:44

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.