A basic way of simple control using native interfaces:

In Windows XP, you can edit the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR

Set the "Start" value stored in this key to a value of "4".

If you would prefer to implement this via GPO in your environment, I would
advise looking at http://support.microsoft.com/kb/555324

Also, to keep in mind: if your organization is intending to use Windows
Server 2003 and Windows Vista, there are a number of GPO settings
specifically targeted to seamlessly target control of the USB ports.

In a Vista environment, I would strongly advise getting ahold of the Windows
Vista Security Guide or referring to it online at
http://www.microsoft.com/technet/windowsvista/security/guide.mspx also
available for download at
http://www.microsoft.com/downloads/details.aspx?FamilyId=A3D1BBED-7F35-4
E72-
BFB5-B84A526C1565&displaylang=en .

A guide has been specifically written for Vista by Microsoft on controlling
removable drive access. This also includes CDRom, floppies, special devices
involving drivers, etc. You can take a look at
http://www.microsoft.com/technet/windowsvista/library/9fe5bf05-a4a9-44e2
-a0c
3-b4b4eaaa37f3.mspx

Hope these resources help in environments where you may be looking for
native methods by which to control device usage.

Wayne S. Anderson

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On
Behalf Of Chris Barber
Sent: Tuesday, July 31, 2007 1:11 PM
To: Michael van Zwieten
Cc: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: Re: USB device control software

Have you checked out Safeboot's Port Control?

http://www.safeboot.com/products/portcontrol/

Chris.

On 7/5/07, Michael van Zwieten <MvanZwieten (at) flcities (dot) com [email concealed]> wrote:
> Hi group... I'm looking for a good USB device control software that
> would prevent people from plugging in USB drives, USB keys, firewire,
> reading/writing to floppy's/CD's/etc. and control this all with Group
> Policy. I'd like to allow some users or groups to be able to use these
> devices, but have the majority of our users blocked from using them.
>
> I've found 2 solutions sofar, and was wondering if you all had any
> experience with these, and what your thoughts are? Or if you have a
> better solution or suggestion?
>
> First one is "Sanctuary Device Control" from SecureWave:
> http://www.securewave.com/usb_security.jsp?rpLangCode=1
>
> Second one is "DeviceLock" from Smartline:
> http://www.protect-me.com/dl/
>
> Thanks much in advance for your responses!
>
> Take care,
> Mike
>
>
>

[ reply ]