How can I prevent users from connecting to a USB storage device?

http://support.microsoft.com/kb/823732

Article ID: 823732 - Last Review: September 23, 2011 - Revision: 7.0

How can I prevent users from connecting to a USB storage device?

System Tip
This article applies to a different version of W indows than the one you are using. Content in this article may not be relevant to you. Visit the W indows Vista Solution Center

To continue receiving security updates for Windows, make sure you're running Windows XP with Service Pack 3 (SP3). For more information, refer to this Microsoft web page: Support is ending for some versions of Windows
(http://windows.microsoft.com/en-us/windows/help/end-support-windows-xp-sp2-windows-vista-without-service-packs) Problem description

Assume that you want to prevent users from connecting to a USB storage device that is connected to a computer that is running Windows XP, Windows Server 2003, or Windows 2000. This article discusses two methods that you can use to do this.
Resolution

To prevent users from connecting to USB storage devices, use one or more of the following procedures, as appropriate for your situation.

If a USB storage device is not already installed on the computer

If a USB storage device is not already installed on the computer, assign the user or the group and the local SYSTEM account Deny permissions to the following files: %SystemRoot%\Inf\Usbstor.pnf %SystemRoot%\Inf\Usbstor.inf When you do this, users cannot install a USB storage device on the computer. To assign a user or group Deny permissions to the Usbstor.pnf and Usbstor.inf files, follow these steps: 1. 2. 3. 4. 5. Start Windows Explorer, and then locate the %SystemRoot%\Inf folder. Right-click the Usbstor.pnf file, and then click Properties. Click the Security tab. In the Group or user names list, add the user or group that you want to set Deny permissions for. In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control.

Note Also add the System account to the Deny list. 6. In the Group or user names list, select the SYSTEM account. 7. In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK. 8. Right-click the Usbstor.inf file, and then click Properties. 9. Click the Security tab. 10. In the Group or user names list, add the user or group that you want to set Deny permissions for. 11. In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control. 12. In the Group or user names list, select the SYSTEM account. 13. In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.

If a USB storage device is already installed on the computer

If a USB storage device is already installed on the computer, you can change the registry to make sure that the device does not work when the user connects to the computer. To have us fix this problem for you, go to the Fix it for me section. If you would rather fix this problem yourself, go to the Let me fix it myself section.

Fix it for me

1 of 2

12/29/2011 11:42 AM