5

We need a way to prevent users from copying anything to and from USB drives unless they are a system administrator. What can be done to remove this access for security purposes.

4
  • 4
    snide answers: (1) seal up all the USB ports with epoxy (2) shoot everyone who's not a sysadmin....
    – Jason S
    Jun 18, 2009 at 19:09
  • @Jeremy E - How will you be able to use your USB Keyboard and Mouse if you disable USB...?
    – JFV
    Jun 18, 2009 at 19:18
  • that's not copying filesystem data; keyboards and mice are Human Interface Devices
    – Jason S
    Jun 18, 2009 at 19:22
  • @Jason S - Sometimes I have a brain... And others... Well you know...
    – JFV
    Jun 18, 2009 at 19:25

10 Answers 10

14

Microsoft has a knowledge base article on this very issue (KB555324). You have to create a custom Group Policy ADM. O'Reilly has an easier to grok writeup at:

Disabling USB Storage With Group Policy | WindowsDevCenter.

Hope this helps.

2

Another option would be to use USBSecure. It's a small deployable script which reads a white list of usb devices from a file share. So you can explicit allow usb storage devices for some users or allow vendor specific devices (e.g. all usb keyboards and mice from logitech). oh, and it's freeware.

2

If you are working with Windows Vista and above, there are Group Policy options that give you fine grained control over which USB devices are allowed or not allowed. (If you have to support WinXP, see the other answers listed here.)

In Windows Vista or above, go to the group policy editor and drill down to: Computer Configuration\Administrative Templates\System\Device Installation\Device Installation Restrictions

There you will find options to white list of black list devices either by specific device IDs or by the class of device. There is also a very important policy at the bottom that allows you to block everything not covered by the other polices.

All you have to know is either the Hardware ID of the device or the Device Class guid. Both of these things can be found in Device Manager if you plug a device into the machine.

Using the policies that are there you could, for example, allows all mice and keyboards, allow a specific model of a USB scanner, and block everything else.

1

In Windows, you can disable the USB Storage driver by setting a registry key. This could be configured in a GPO and applied to a limited set of machines. If you want to allow a subset of USB storage devices you will probably have to turn to a third-party product that runs some sort of agent.

1

Epoxy works great

7
  • Seriously, heard of many companies doing this. Jun 18, 2009 at 19:12
  • I think I heard that the NSA or CIA or military did this, can't find a reference to it though. Anyone find an article online?
    – Jason S
    Jun 18, 2009 at 19:13
  • Didn't Jason S just say that?
    – MathewC
    Jun 18, 2009 at 19:15
  • There are some issues with this approach. Most keyboards and mice are USB based these days. Those ports will remain functional even if you epoxy the devices themselves to the case, and can be used for dark purposes simply by prying the current device out.
    – Yannone
    Jun 18, 2009 at 19:18
  • 1
    I've not seen USBs dripping with epoxy. But, in a former life (CERT team), I helped desolder radios/antennas to eliminate wifi security issues in laptops. Fun days.
    – dr.pooter
    Jun 18, 2009 at 20:01
1

A quick and dirty fix will be to use a group policy disabling access to usb devices, take a look at the following article. There are also commercial products which can accomplish the same thing, with better grained security.

1

GPO will disable the drivers:

http://support.microsoft.com/default.aspx/kb/555324

1

All solution are nice, but you need also to think about a process to be able to load data from USB.

I am in a bank at the moment and by default all USB port are lock with a GPO who will not load disk.

Problem is they dont have a process when an external consultant come to load some data, its a real pain to transfer iso file, or any documents, because if you cant plug USB key, also you cant plug laptop on the network.

If you lock all your USB, dont forget you still need sometime a way to load data from USB, and 5GB of data across the web/mail is not always an answer.

Security always come with a price.

1

i think better solution is DeviseLock software: http://www.devicelock.com/ It is real useful and have huge functional.

0

MyUSBonly from AC Element Company and StopUSB from EverStrike will also work.

Both of them ask for a password if you want to mount a new, unknown USB device.

To be honest, both could be better designed, but at least they do the job.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .