Stopping the use of USB drives

Coldzero · 15 Sep 2009 at 08:52

Do any of you guys block the use of usb drives on your network? can this be done via a gp?

UKDTweak · 15 Sep 2009 at 08:56

I do in our place, can be done via GP, I import a .reg file that disables the usb Store so any usb devices inserted are not detected...

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR]
"Start"=dword:00000004

Coldzero · 15 Sep 2009 at 09:07

Thanks a lot.

siuko · 15 Sep 2009 at 09:19

If you are running a Domain Controller and have your computers joined to it.

There are options using GPO to allow or deny USB access depending on the user or group.

I work in a school - and we have it set so staff can access usb but students cannot.

Coldzero · 15 Sep 2009 at 09:30

siuko does that not stop the use of usb keyboards etc doing it that way?

RSR · 15 Sep 2009 at 10:14

We block USB sticks, they can be blocked via GPOs as above. However, we block ours via our AV.

Andy

siuko · 15 Sep 2009 at 11:52

Coldzero said:
siuko does that not stop the use of usb keyboards etc doing it that way?

Nope - its actually just preventing access to any drives that we dont want them to access.

So everything USB works ok

Ev0 · 15 Sep 2009 at 12:58

We use a paid up product that allows monitoring and control of USB devices, but as said it costs

iaind · 15 Sep 2009 at 13:16

I wish I could find a product that works in Citrix/TS environments properly

platypus · 15 Sep 2009 at 14:47

siuko said:
If you are running a Domain Controller and have your computers joined to it.

There are options using GPO to allow or deny USB access depending on the user or group.

I work in a school - and we have it set so staff can access usb but students cannot.

Hmm interesting. Is there anyway to disable usb storage devices, but allow mobile devices to connect via activesync?

siuko · 16 Sep 2009 at 11:58

I would guess if the mobile devices can sync without mapping a drive then yes they should work ok.

It doesnt stop any USB working - it just makes it so when a usb storage device is plugged in you cant see the drive it creates

platypus · 16 Sep 2009 at 13:11

Oh, nice.

Basher · 16 Sep 2009 at 13:38

iaind said:
I wish I could find a product that works in Citrix/TS environments properly

Lumension, SEP, Vontu?

iaind · 16 Sep 2009 at 15:18

Basher said:
Lumension, SEP, Vontu?

Lumension doesnt,havent heard of the other 2.

Anything that needs direct access to the USB ports wont work as they are effectively mapped as network drives

Basher · 16 Sep 2009 at 15:20

iaind said:
Lumension doesnt,havent heard of the other 2.

Anything that needs direct access to the USB ports wont work as they are effectively mapped as network drives

The other two are from Symantec - ENdpoint Protection and Vontu (DLP)

Nikumba · 18 Sep 2009 at 08:33

iaind said:
I wish I could find a product that works in Citrix/TS environments properly

You can. We use GPO on all our machines. We basically remove drive letters. We basically allow C: and the network drives, nothing else.

Then we have policies to allow use of the cd drive in laptops for instance

Kimbie

tonym · 18 Sep 2009 at 08:37

Ev0 said:
We use a paid up product that allows monitoring and control of USB devices, but as said it costs

As do we. We use a product called Sanctuary which can stop anything being used. For all I moan about it every time someone needs to read a CD, it's great for keeping control of the PC's.
No-one can add anything without us knowing about it, and when you do allow USB or CD access, it can shadow copy, so we can see exactly what has been put on or copied off the network.

Ev0 · 18 Sep 2009 at 09:22

tonym said:
As do we. We use a product called Sanctuary which can stop anything being used. For all I moan about it every time someone needs to read a CD, it's great for keeping control of the PC's.
No-one can add anything without us knowing about it, and when you do allow USB or CD access, it can shadow copy, so we can see exactly what has been put on or copied off the network.

I think most people with a paid up product use this tbh

iaind · 18 Sep 2009 at 10:26

Nikumba said:
You can. We use GPO on all our machines. We basically remove drive letters. We basically allow C: and the network drives, nothing else.

Then we have policies to allow use of the cd drive in laptops for instance

Kimbie

We want to enable staff to use USB sticks, but only pre-approved hardware encrypted sticks...

Nikumba · 18 Sep 2009 at 10:49

iaind said:
We want to enable staff to use USB sticks, but only pre-approved hardware encrypted sticks...

Ah fair enough

Kimbie