Dear Customer,
To disable the USB Storage, we can do the following:
1. If a USB storage device is not already installed on the computer, assign the user or the group Deny permissions to the following files:
- %SystemRoot%\Inf\Usbstor.pnf
- %SystemRoot%\Inf\Usbstor.inf
If the computers are in the domain, you can do the following:
To set the file permission from GPO:
a. Open Domain Policy or OU policy which will apply to client computers.
b. Expand Computer Configuration\Windows Settings\Security Settings\File System.
c. Right click the File system, select Add File, type c:\windows\inf\Usbstor.pnf in text box and click OK.
d. Set the permission to deny the users read/write/full control the file. NOTE: Please just add the user account, do not deny everyone group.
e. Click ok to end the configuration.
f. Repeat the step c to step e to add Usbstor.inf at this time.
You will see that %SystemRoot%\Inf\Usbstor.pnf and %SystemRoot%\Inf\Usbstor.inf item will be listed in the right panel. When the GPO applies, this setting will apply to all the domain members. Users will not have the permission to read and file and then cannot add the USB storage device.
2. If a USB storage device is already installed on the computer, set the "Start" value in the following registry key to 4:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
For more information, please refer to:
823732 HOW TO: Disable the Use of USB Storage Devices in Windows XP http://support.microsoft.com/?id=823732
To set the registry key:
There is a command line: Reg.exe on Windows 2000 and Windows XP support tools which can help us to modify registry key from command line.
You can write a batch file to set the data of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor\start to 4.
Then add the batch file to domain or OU GPO as computer startup policy, when domain member starts up, this batch file will applied to domain members and installed USB storage device cannot be used.
There is a third party tool to manage the USB storage device, for more information, please refer to:
http://www.reflex-magnetics.com/products/disknetpro/
NOTE: This response contains a reference to a third-party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites; therefore, Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. There are inherent dangers in the use of any software found on the Internet, and Microsoft cautions you to make sure that you completely understand the risk before retrieving any software from the Internet.
Hope it helps.
Thanks & Regards
Tom Zhang
