1

I know that I can disable USB devices using group policy for the computers of my company. What I want to achieve is allow users to use the USB port only for charging their phones, connect their mouse and keyboard but NOT allow file sharing from removable media to computer (and vice versa).

So my question is how do I ensure that this policy works if:

  • Some of the users have laptops, and in some cases, they work from home and are not connected to the domain
  • Some of the users are local admins to their computer
Improve this question

1 Answer 1

Reset to default
2

This is one of those "I want to install a lock that will keep out all burglars" type of questions. The short answer is that you can install policies that will keep most of your honest users honest, but you cannot guarantee 100% compliance.

Your end goal (I assume) is not just to prevent USB drives, but to prevent unauthorized data copying. You will not be 100% successful at blocking USB drives, especially because those users with admin rights will be able to modify any policies put in place. But even if you prevented data copying via USB drives, these machines have network connections, no?

Improve this answer
4
  • 1
    This is incorrect.
    – leaustinwile
    Commented Jul 30, 2019 at 16:23
  • 5
    @leaustinwile, please elaborate to help those finding this question know how and in what way this answer is incorrect.
    – spuck
    Commented Jul 30, 2019 at 17:53
  • You can block USB via GPO and the device will still charge. serverfault.com/questions/576768/… That link describes how to disable USB via GPO. The company I work for has disabled USB storage this way but charging my device still in fact works. If the user is local admin and isn't routing through your organizations security stack, it may be difficult to enforce something like this.
    – leaustinwile
    Commented Aug 1, 2019 at 1:32
  • Thank you for your answers, I guess I can only be reactive in this case (Event Viewer Log for plugging in portable device)
    – elli
    Commented Aug 1, 2019 at 8:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .