Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to disable windows machine in the domain from copying files to one's own portable devices. I found a setting that will tell the registry which will tell the computer to 'writeprotect'(StorageDevicePolicies\WriteProtect) portable storage devices. However, smartphones are found to bypass the setting by presenting itself as a portable media player. How shall I block that too?

share|improve this question
1  
It seems that there is something called MediaTransferProtocol(MTP) involved. –  billyswong Sep 28 '12 at 8:01

2 Answers 2

Can you disable all MTP devices outright? It would break both read and write to those devices, but in a secure environment you may not care. The removable device write protect option is a special case to handle that kind of thing. Apparently it only covers removable block devices.

It would be crude but if you can identify an .inf file or .sys driver file specific to MTP devices and then delete or deny all access (including to SYSTEM which is what the PlugAndPlay service runs under) access to it, the device would not function when plugged into the system.

If you go into device manager, find the device and look in the Details tab under Properties, Inf name will tell you the name of the .inf file that best identified the device. Under Driver -> Driver Details it will list the actual driver binaries loaded to support the device.

Take care to disable an .inf or .sys file specific only to that kind of device, lest you disable something critical. Try it in a VM (make a snapshot first) and make sure it doesn't break anything else.

All things being equal, disabling only the .inf would probably be better than a .sys file. Disabling access through security will probably work better as SFP may just replace the files you delete.

share|improve this answer
    
The disabling of the inf does work, but apparently not something that can be set in domain policy –  billyswong Dec 11 '12 at 5:09
1  
You can make a logon script part of a domain policy and have that script delete the .inf –  Chris Smith Dec 11 '12 at 15:35
    
Thanks for update. I have convinced my boss not messing with system files a couple months ago though. So no need for the script –  billyswong Dec 13 '12 at 5:58
    
In addition to this, you can audit the registry and delete any devices with MTP in their CompatibleIDs. See gist.github.com/mbrownnycnyc/5118310 –  mbrownnyc Mar 8 '13 at 17:45

Following would block MTP connected device access

Computer Configuration\Administrative Templates\System\Removable Storage Access

WPD Devices - Deny read access - enable

source : http://msdn.microsoft.com/en-us/library/bb530324.aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.