Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I has a very simple task. I need to block access to removable media (CD, DVD, floppy, USB drives etc.) on a Windows 2008 R2 Terminal Server for users and allow it for admins.

I tried to enable the following policy in GPO:------

User Configuration/Administrative Templates/System/Removable Storage Access

All Removable Storage classes: Deny all access = Enabled

But it did not work. I tried different physical and virtual 2008 servers with the same result. It works on Windows 7 but not on Windows 2008.

Has anyone had success with this parameter on Windows 2008?

Thank you

share|improve this question
Disable the device under device manager, an admin could go turn it back on when they need it. – SpacemanSpiff Nov 21 '12 at 4:56
This is good if admins know that the devices were disabled this way. – Volodymyr M. Nov 21 '12 at 11:25

Configure the same policy in Computer Configuration section. The User Configuration setting is inconsequential because the Computer Configuration policy overrides.

Link GPO to the OU where terminal server resides.Then configure Security Filtering to apply settings in GPO to the users/groups/computers you need (i.e. your users and terminal server).

share|improve this answer
If I put this in Computer policies, it will be applied to all users including administrators. I want administrators to be able to have access to DVD. I am not sure that security filering on computer policies will have effect on user groups. – test1839 Nov 21 '12 at 15:12
That's the point, with Security Filtering you can apply settings ONLY to the users/groups/computers you need. – Volodymyr M. Nov 21 '12 at 15:26
Not sure to understand. If the parameter is set in the Computer policy it will apply to computer objects only and won't apply to user profiles. So if I do as you recommend, I will get the policy applied to the whole computer, which will block the access for all users including admins, which I do not want. – test1839 Nov 22 '12 at 0:07
Yes, seems like you are right. I thought there is an exception for Computer Settings, like there's for User Settings (i.e. loopback processing, if user needs to have policies applied based on the location of the computer). – Volodymyr M. Nov 22 '12 at 11:02
Perhaps, logon script which will disable access to removable devices is what you need. – Volodymyr M. Nov 22 '12 at 11:29
up vote 0 down vote accepted

Contacted Microsoft. They confirmed that this is "undocumented behavior". So this policy is not working "by design" on W2K8 Terminal Server if applied via User GPO.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.