OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Disabling USB mass storage

From: Glenn S. (glennsecureinformation.net)
Date: Thu Mar 03 2005 - 13:33:20 CST

A glue gun or superglue works wonders. If that is too extreme there are some
other options.

Do you have SP2 installed? If yes then there are GPO's you can use. This
site details a way to do it for both SP2 and earlier:
I found it on a website that addresses the issue of read-only USB ports.
The second section covers pre-SP2 machines. I have not tested it yet myself.
http://www.gpanswers.com/faq/?id=10

How do I prevent people from writing data to the USB port? (ie: USB Flash
disk, etc)

You can create an ADM template to do this.

Here is the code to restrict XP/SP2:

(This will 'Write Protect' the device, similar to flipping the tab on a
floppy disk)

CLASS MACHINE

CATEGORY "USB Storage"

  POLICY "Write Protect USB Storage"
    KEYNAME "SYSTEM\CurrentControlSet\Control\StorageDevicePolicies"
    VALUENAME "WriteProtect"
    VALUEON NUMERIC 1
    VALUEOFF NUMERIC 0
  END POLICY
END CATEGORY

Save as a .ADM file, load it in, and go !

or

To prevent machines pre-XP/SP2...

(This will disable the storage device completely, i.e no read or write)

CLASS MACHINE

CATEGORY "USB Storage"

  POLICY "Disable USB Storage"
    KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR"
    VALUENAME "Start"
    VALUEON NUMERIC 4
    VALUEOFF NUMERIC 3
  END POLICY
END CATEGORY

----- Original Message -----
From: "Martin a Marika TYDOROVCI" <tydyszm.sk>
To: <focus-mssecurityfocus.com>
Sent: Wednesday, March 02, 2005 3:10 PM
Subject: Disabling USB mass storage

> Hi list,
>
> Does anyone knows a way to disable USB mass storage device in Win XP? I
> need to disable using devices such as USB flash drive, card readers, etc.
>
> Regards
>
> ---------------------------------------------------------------------------
> ---------------------------------------------------------------------------
>

---------------------------------------------------------------------------
---------------------------------------------------------------------------