Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you lock out the USB ports on the desktop PCs so we can prevent usage of USB drives on the desktops.

I should clarify that these are Windows XP desktops.

We should also assume that like most of the new desktops, many are using USB for keyboards and/or mice.

share|improve this question
1  
do they have USB mice/keyboards? –  pjz May 6 '09 at 21:41
    
Take a look at the answers to this question. –  epotter Aug 19 '09 at 13:43
add comment

13 Answers

up vote 6 down vote accepted

There should be a Group Policy Object for this, you can push it through Active Directory. See in gpedit.msc on WinXP Pro.

share|improve this answer
1  
I don't think that will keep people from booting from a USB stick. –  pjz May 6 '09 at 18:22
5  
+1 Though is booting from one such a problem? That could be changed in the BIOS Setup and then password protected... –  Oskar Duveborn May 6 '09 at 19:09
    
Which settings is it? –  epotter Aug 18 '09 at 13:56
    
Which setting depends on the BIOS. Look for features that enable/disable usb boot and/or selecting boot drives at startup. –  lexu Oct 29 '09 at 6:19
add comment

If they're Windows desktops, you can use the local policy (or group policy, if it's Active Directory). There isnt's a default setting for it, but the MS-provided template can be found under MSKB 555324.

share|improve this answer
    
That link is broken. I am guessing it's .com not .cim. –  Mike Wills May 7 '09 at 14:59
1  
Now that's just crazy talk. –  Kara Marfia May 8 '09 at 11:54
add comment

You should be able to disable the usb ports from the computer's BIOS. You could also, unplug the cables from them to the motherboard.

share|improve this answer
1  
What if the keyboard and/or mouse is USB? That wouldn't work. –  Mike Wills May 6 '09 at 18:29
1  
Then you'll have to use a USB to PS/2 converter. –  Adam Gibbins May 6 '09 at 18:45
1  
@ Mike Wills, true, however if you don't disable all of the ports like Chris Upchurch (see below) said you will still run into the problem you are trying to avoid. It may all depend on how computer savvy your users are. If you don't want them plugging in 'dirty' usb drives, unplugging the front connecter may be enough. –  RateControl May 6 '09 at 19:08
7  
@Adam: lots of computers don't even come with PS/2 ports these days. –  Chris Upchurch May 6 '09 at 19:16
2  
The right solution is to disable the use of removable USB storage devices, anything else will have gaping holes you can drive a truck through. Given that this is a security issue, you definitely want to get it right rather than kinda, sorta, mostly right. –  Wedge May 7 '09 at 1:04
add comment

I don't think disabling ports is really going to do what you seem to want. Not unless these computers use PS2 mice and keyboards. As long as you have available USB ports for the keyboard and mouse, someone can just plug a hub in and plug their USB drive into that. What you really want to do is prevent the computer from recognizing USB storage devices (but not other USB devices) plugged in via USB.

share|improve this answer
add comment

If the users have administrative rights to their PCs, they can override anything you do to prevent this. However, you can follow the below link to Microsoft's recommended solution:

http://support.microsoft.com/kb/823732

You can also prevent booting from a USB stick in the BIOS, as has already been mentioned.

share|improve this answer
add comment

If you are concerned about using a software solution you could buy some hardware locks.

USB Port Blocker

This assumes that you have the budget to get these for each machine. You may also need keep people from unplugging the keyboard and mouse if they are USB as well.

share|improve this answer
add comment

Two solutions that I've seen at customer sites:

  • (Linux) Blacklist the relevant USB kernel modules (usb_storage) in the appropriate /etc/modprobe.conf-type file
  • Hot glue gun
share|improve this answer
add comment

In the BIOS, Set the boot device to boot only from hard disk and password protect the BIOS. In the BIOS, disable all USB devices that you can get away with. To prevent USB sticks from even being mounted, you'll need to take other measures. Can you put the computer in a box with only the keyboard and mouse cables coming out? Then there is no available USB port for them to fiddle with.

The bottom line is that as long as you don't trust people who have physical access to the machine, you can only improve security but you cannot get absolute security.

share|improve this answer
add comment

I've had to do this on stand-alone machines as well as on several domain machines. GPO would be a better way to go but I didn't have the luxury of doing it that way. Obviously if someone had admin rights over the machine and a little knowledge they could undo this.

At the time I was using this, we had all XP machines. No users had admin rights. No users are [supposed to be] Power Users. To help keep users from using USB mass storage devices, some other admins deleted USBSTOR.SYS. So if I ever needed to reenable USB mass storage devices, I needed to restore the driver file as well. (So I kept a current copy handy along with the files below). My copy of the "Enable.bat" has a line -- I commented out here -- to restore the file as necessary.

Disable.bat:

(May have to add "BUILTIN\Administrators" to the CACLS commands. I did not have to in my environment)

@echo off
REM *********************************************************************
REM Disabling USB Mass Storage Driver
REM *********************************************************************
echo Disabling USB Mass Storage Driver
CACLS %SYSTEMROOT%\system32\Drivers\USBSTOR.SYS /E /D "BUILTIN\Users" "NT AUTHORITY\SYSTEM" "BUILTIN\Power Users"
CACLS %SYSTEMROOT%\INF\UsBSTOR.INF /E /D "BUILTIN\Users" "NT AUTHORITY\SYSTEM" "BUILTIN\Power Users"
REG.EXE IMPORT "Disable.reg"

Disable.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR] 
"Start"=dword:00000004

Enable.bat

(May have to add another set of CACLS commands for "BUILTIN\Administrators". I did not have to in my environment)

@echo off
REM *********************************************************************
REM Enabling USB Mass Storage Driver
REM *********************************************************************
echo Enabling USB Mass Storage Driver
REM XCOPY /E /Y /I USBSTOR.SYS %SYSTEMROOT%\system32\Drivers
CACLS %SYSTEMROOT%\system32\Drivers\UsBSTOR.SYS /E /G "BUILTIN\Users":R
CACLS %SYSTEMROOT%\system32\Drivers\UsBSTOR.SYS /E /G "NT AUTHORITY\SYSTEM":R
CACLS %SYSTEMROOT%\system32\Drivers\UsBSTOR.SYS /E /G "BUILTIN\Power Users":R
CACLS %SYSTEMROOT%\INF\UsBSTOR.INF /E /G "BUILTIN\Users":R
CACLS %SYSTEMROOT%\INF\UsBSTOR.INF /E /G "NT AUTHORITY\SYSTEM":R
CACLS %SYSTEMROOT%\INF\UsBSTOR.INF /E /G "BUILTIN\Power Users":R
REG.EXE IMPORT "Enable.reg"

Enable.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR] 
"Start"=dword:00000003

Something similar may work for Vista -- BUT I HAVE NOT TRIED IT.

share|improve this answer
add comment

I prefer to train the users as to what is acceptable and what is not acceptable. If you cannot trust your users that far, then take away their PCs and set up a thin client systems connecting back to something like a Citrix server running all your apps. The only other solution I can think of is to place the actual PC in a locked cabinet with just the cables for the keyboard, mouse, and monitor coming out. In all cases I think you will just end up creating more work for your self.

share|improve this answer
1  
You live in an ideal world... –  Josh Oct 29 '09 at 0:51
add comment

If you are looking to effectively 'remove' those ports from the computer (and you need USB at all), AND if you are willing to modify the computer, may I suggest 2 part epoxy? Cover the connector with epoxy and no one is ever plugging anything in there again. Hot Melt glue is a bit less permanent, but still pretty effective.

Assuming you still need USB ports for keyboard/mouse, you're going to have to leave a port or two uncovered.

share|improve this answer
    
This is a legit answer in some circumstances. –  duffbeer703 Oct 29 '09 at 3:45
add comment

Drivelock. Also mirrors files from USB sticks if so desired, and allows whitelisting and blacklisting of devices, file types, and users.

share|improve this answer
add comment

You can disable USB storage via:

http://support.microsoft.com/kb/823732

It's also possible to make USB storage read only. This is often a good compromise, as it allows users to read data off a USB device - like photos from a camera, but prevents them from copying your corporate database onto their memory stick.

http://www.petri.co.il/configure%5Fusb%5Fdisks%5Fto%5Fbe%5Fread%5Fonly%5Fin%5Fxp%5Fsp2.htm

It's probably not advisable to attempt to disable USB entirely, as things like keyboards and mice generally require USB these days. Both of the above can be set via a registry entry or a policy file. The strength of these settings will be as strong as your Windows policy and group settings.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.