Skip to main content

Policy to Restrict USB Ports

By

You can restrict the type of USB drives that are allowed on your clients be using group policy. I would like to give a word of caution when implementing this. You should consider having a “Support Device List.” This will allow your organization to formally declare what can and cannot be plugged into your USB drives. Without such a list, a constant flow of requests will come in to add more and more devices. It is best to draw the line early and have a formal review process to make sure that the number of supported devices does not become unmanageable.

Settings to control USB Device Access:

Policy Location

Computer Configuration \ Administrative Templates \ System \ Device Installation \ Device Installation Restriction

Policy Name

Prevent installation of devices not described by other policy settings

Setting

Enable

Configuration

  

Description

Prevents other USB devices from being installed unless they are specifically allowed in a policy.

Procedure to get Plug and Play device IDs to allow devices to be used on the clients.

· Plug the device into a client that does not have a policy restricting devices.

· Click Start

· Type Device

· Click Device Manager from the list.

· Expand the category for the device you plugged in and then double click the device

image

· Click the Details tab.

image

From here, you need to decide if you are going to allow a class of devices to work on the client. An example of this would be for mice and keyboards. You can also specify a specific device like the USB hard Drive that we will be deploying images on.

For a specific device:

· In the drop down list, select Hardware IDs.

· Copy the information from the first entry. This is the exact hardware ID for this device.

image

· Browse to the section of the Local Policy below and enter that value in the Configuration of the policy.

· A reboot is required.

The policy below will specify a specific hardware device.

Policy Location

Computer Configuration \ Administrative Templates \ System \ Device Installation \ Device Installation Restriction

Policy Name

Allow installation of devices that match any of these device IDs

Setting

Enable

Configuration

USBSTOR\DiskWD_____My_Passport_07401003

Description

The configuration is the Hardware ID of the USB Device that you want to allow to connect to the client.

Note: This setting can be omitted. To use a USB device, log in as a local administrator and set the policy below labeled Allow administrators to override Device Installation Restriction Policies.

To allow a class of devices like mice and keyboards

image

· In the drop down list select Device Class Guid

· Record the guid (curly braces and all).

· Browse to the section of the Local Policy below and enter that value in the Configuration of the policy.

· A reboot is required.

The policy below will specify a specific hardware device.

Policy Location

Computer Configuration \ Administrative Templates \ System \ Device Installation \ Device Installation Restriction

Policy Name

Allow installation of devices that match these device setup classes

Setting

Enable

Configuration

{4d36e96f-e325-11ce-bfc1-08002be10318}

Description

The configuration is the Hardware ID of the USB Device that you want to allow to connect to the client.

GUID ID for Mouse and Keyboard: {4d36e96f-e325-11ce-bfc1-08002be10318}

Policy Location

Computer Configuration \ Administrative Templates \ System \ Device Installation \ Device Installation Restriction

Policy Name

Allow administrators to override Device Installation Restriction Policies.

Setting

Enable

Configuration

  

Description

This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings.

If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server.

If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation.

Labels

Labels:

Comments

Post a Comment

Popular posts from this blog

How to list all the AD LDS instances on a server

By
AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.
Post a Comment
Read more

How to run GPResult on a remote client with PowerShell

By
In the past, to run the GPResult command, you would need to either physically visit this client, have the user do it, or use and RDP connection.  In all cases, this will disrupt the user.  First, you need PowerShell remoting enabled on the target machine.  You can do this via Group Policy . Open PowerShell and type this command. Invoke-Command –ScriptBlock {GPResult /r} –ComputerName <ComputerName> Replace <ComputerName> with the name of the target.  Remember, the target needs to be online and accessible to you.
Post a Comment
Read more

Where did a User’s Account Get Locked Out?

By
Updated: May 15, 2015 When this article was originally published, two extra carriage returns were add causing the code to malfunction.  The code below is correct.   My client for this week’s PowerShell class had a really interesting question. They needed to know where an account is being locked out at. OK, interesting. Apparently users hop around clients and forget to log off, leading to eventual lock out of their accounts. The accounts can be unlocked, but are then relocked after Active Directory replication. This problem is solved in two parts. The first one is to modify the event auditing on the network. The second part is resolved with PowerShell. The first part involves creating a group policy that will encompass your Domain Controllers. In this GPO, make these changes. Expand Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Account Management Double click User Account Management C...
18 comments
Read more