Disable USB partially

Hello

In our company we need to disable the access to the devices of storage USB,
but only partially.

I know that it is possible to disable totally or only the writing across the
regedit, but it is not for what we look.

We need that the manager's account has access to these devices (already
installed), but the user's accounts do not.


Thank you very much

Guillermo AG <GuillermoAG@discussions.microsoft.com> wrote:
> Hello
>
> In our company we need to disable the access to the devices of
> storage USB, but only partially.
>
> I know that it is possible to disable totally or only the writing
> across the regedit, but it is not for what we look.
>
> We need that the manager's account has access to these devices
> (already installed), but the user's accounts do not.
>
>
> Thank you very much

If you have a Windows domain, this is something you could handle via group
policy. Try posting in microsoft.public.windows.group_policy for more help.

If your goal is to stop users from copying files, then blocking write access
to USB drives won't completely address your need. There are many ways that
people can export data, and determined users will try them all:

* Burning to CD/DVD
*Emailing to external webmail
* Printing
* Copying to an externally-accessible server, then obtaining from outside

What is the security risk you're trying to mitigate?


--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com



"Guillermo AG" <GuillermoAG@discussions.microsoft.com> wrote in message
news:CD06ED1D-B112-4B11-8B7B-53E68A881CC3@microsoft.com...
> Hello
>
> In our company we need to disable the access to the devices of storage
> USB,
> but only partially.
>
> I know that it is possible to disable totally or only the writing across
> the
> regedit, but it is not for what we look.
>
> We need that the manager's account has access to these devices (already
> installed), but the user's accounts do not.
>
>
> Thank you very much