How to use a group policy to disable USB in the domain controller (1)

Windows 2003Domain ControllerUseGroup PolicyThe following describes how to disable USB:

1. Disable the usb registry directly.

Go

 
 

  
  
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/USBSTOR   
 
 

There is a key value named start on the right.

Double-click it and change the value to 4 usb to disable it.

You only need to change 4 to 3 for the next recovery.

Ii. Indirect Method

Copy the content in the lower slash to a text document and save it. ADM file, then open the OU group policy you want to restrict, expand "user configuration, manage template", right-click the management template, add/delete template, import the saved ADM file! Now all users under this OU cannot use USB storage devices! Third-party software GFI LANGuard Portable Storage Control. v2.0 can also be used in the domain environment ).

//////////////////////////////////////// //////////////

 
 

  
  
CLASS USER
  
  
 
  
  
CATEGORY !! ADMDesc
  
  
 
  
  
POLICY !! MMC_DeviceManagerX
  
  
 
  
  
KEYNAME "Software/Policies/Microsoft/MMC/{90087284-d6d6-11d0-8353-00a0c90640bf }"
  
  
 
  
  
# If version> = 4
  
  
 
  
  
SUPPORTED !! SUPPORTED_Win2k
  
  
 
  
  
# Endif
  
  
 
  
  
EXPLAIN !! MMC_Restrict_Explain
  
  
 
  
  
ValueNAME "Restrict_Run"
  
  
 
  
  
ValueON NUMERIC 0
  
  
 
  
  
ValueOFF NUMERIC 1
  
  
 
  
  
END POLICY
  
  
 
  
  
POLICY !! MMC_DeviceManager
  
  
 
  
  
KEYNAME "Software/Policies/Microsoft/MMC/{74246bfc-4c96-11d0-abef-0020af6b0b7a }"
  
  
 
  
  
# If version> = 4
  
  
 
  
  
SUPPORTED !! SUPPORTED_Win2k
  
  
 
  
  
# Endif
  
  
 
  
  
EXPLAIN !! DEVMGR_Restrict_Explain
  
  
 
  
  
ValueNAME "Restrict_Run"
  
  
 
  
  
ValueON NUMERIC 0
  
  
 
  
  
ValueOFF NUMERIC 1
  
  
 
  
  
END POLICY
  
  
 
  
  
End CATEGORY
  
  
 
  
  
CLASS MACHINE
  
  
 
  
  
CATEGORY !! ADMDesc
  
  
 
  
  
POLICY !! USB_UHCD_PARAMS
  
  
 
  
  
KEYNAME "SYSTEM/CurrentControlSet/Services/uhcd"
  
  
 
  
  
EXPLAIN !! STARTUPTYPE_HELP
  
  
 
  
  
PART !! STARTUPTYPE NUMERIC REQUIRED
  
  
 
  
  
ValueNAME "START"
  
  
 
  
  
MIN 3 MAX 4 DEFAULT 3
  
  
 
  
  
END PART
  
  
 
  
  
END POLICY
  
  
 
  
  
POLICY !! USB_UHCI_PARAMS
  
  
 
  
  
KEYNAME "SYSTEM/CurrentControlSet/Services/usbuhci"
  
  
 
  
  
EXPLAIN !! STARTUPTYPE_HELP
  
  
 
  
  
PART !! STARTUPTYPE NUMERIC REQUIRED
  
  
 
  
  
ValueNAME "START"
  
  
 
  
  
MIN 3 MAX 4 DEFAULT 3
  
  
 
  
  
END PART
  
  
 
  
  
END POLICY
  
  
 
  
  
POLICY !! USB_EHCI_PARAMS
  
  
 
  
  
KEYNAME "SYSTEM/CurrentControlSet/Services/usbehci"
  
  
 
  
  
EXPLAIN !! STARTUPTYPE_HELP
  
  
 
  
  
PART !! STARTUPTYPE NUMERIC REQUIRED
  
  
 
  
  
ValueNAME "START"
  
  
 
  
  
MIN 3 MAX 4 DEFAULT 3
  
  
 
  
  
END PART
  
  
 
  
  
END POLICY
  
  
 
  
  
POLICY !! USB_HUB
  
  
 
  
  
KEYNAME "SYSTEM/CurrentControlSet/Services/usbhub"
  
  
 
  
  
EXPLAIN !! STARTUPTYPE_HELP
  
  
 
  
  
PART !! STARTUPTYPE NUMERIC REQUIRED
  
  
 
  
  
ValueNAME "START"
  
  
 
  
  
MIN 3 MAX 4 DEFAULT 3
  
  
 
  
  
END PART
  
  
 
  
  
END POLICY
  
  
 
  
  
POLICY !! CD_ROM
  
  
 
  
  
KEYNAME "SYSTEM/CurrentControlSet/Services/cdrom"
  
  
 
  
  
EXPLAIN !! STARTUPTYPE_HELP
  
  
 
  
  
PART !! STARTUPTYPE NUMERIC REQUIRED
  
  
 
  
  
ValueNAME "START"
  
  
 
  
  
MIN 3 MAX 4 DEFAULT 3
  
  
 
  
  
END PART
  
  
 
  
  
END POLICY
  
  
 
  
  
POLICY !! Floppy_Disk
  
  
 
  
  
KEYNAME "SYSTEM/CurrentControlSet/Services/flpydisk"
  
  
 
  
  
EXPLAIN !! STARTUPTYPE_HELP
  
  
 
  
  
PART !! STARTUPTYPE NUMERIC REQUIRED
  
  
 
  
  
ValueNAME "START"
  
  
 
  
  
MIN 3 MAX 4 DEFAULT 3
  
  
 
  
  
END PART
  
  
 
  
  
END POLICY
  
  
 
  
  
End CATEGORY
  
  
 
  
  
[Strings]
  
  
 
  
  
ADMDesc = "custom policy"
  
  
 
  
  
MMC_DeviceManagerX = "Device Manager extension"
  
  
 
  
  
MMC_DeviceManager = "Device Manager"
  
  
 
  
  
SUPPORTED_Win2k = "at least Microsoft Windows 2000"
  
  
 
  
  
MMC_Restrict_Explain = "Disable -- Disable the Device Manager extension; Enable -- Enable the Device Manager extension"
  
  
 
  
  
DEVMGR_Restrict_Explain = "Disable -- Disable the Device Manager; Enable -- Enable the Device Manager"
  
  
 
  
  
USB_UHCD_PARAMS = "USB universal master controller drive"
  
  
 
  
  
STARTUPTYPE_HELP = "Startup type, 3-manual, 4-Disabled"
  
  
 
  
  
STARTUPTYPE = "Startup Type"
  
  
 
  
  
USB_EHCI_PARAMS = "Microsoft USB 2.0 Enhanced Host Controller Miniport Driver"
  
  
 
  
  
USB_UHCI_PARAMS = "Microsoft USB Universal Host Controller Miniport Driver"
  
  
 
  
  
USB_HUB = "Microsoft USB Standard Hub Driver"
  
  
 
  
  
CD_ROM = "Optical Drive"
  
  
 
  
  
Floppy_Disk = "soft drive"
  
  
 
 
 

//////////////////////////////////////// //////////////////