Removable Storage Access Group Policy settings in Windows Server 2008

In Windows Server 2008, administrators can apply Group Policy to control whether a user can read or write to any device that uses removable media. These policies can be used to help prevent sensitive or confidential material from being written to removable media or removable devices that contain storage areas.

This policy setting can be found in two locations. The policy settings found in Computer Configuration \ Administrative Templates \ system \ Removable Storage access affect the computer and each user who logs on to the computer. The policy settings found in User Configuration \ Administrative Templates \ system \ Removable Storage access affect only the users to whom policy settings are applied, including groups (if Group Policy is applied with Active Directory).

Each device class supports two policies: one is denying read access and the other is denying write access:

-The time, in seconds, that the reboot was enforced. Set the time (in seconds) to wait for the reboot system to enforce changes to access permissions on Removable storage devices. A reboot is enforced only if the restriction policy cannot be applied without restarting.

-CDs and DVDs. These policy settings allow you to deny read or write access to devices in the CD and DVD Removable Storage classes, including devices that are connected by USB.

Instance:

(i) Preparatory work

-Client computers running Windows Vista. assumed to be dmi-client.

-USB storage drive. The scenario described in this guide uses a USB storage drive as a sample device. This device is like a removable disk drive, which is also known as "thumb drive", "flash drive", or "keychain drive." Most USB storage drives do not require any drivers provided by the manufacturer, which use the drivers provided by Windows Server 2008.

(ii) Use Device Manager to find the device identification string

1. Log on to the computer as Dmi-client\testadmin.

2. Insert the USB storage drive and complete the installation.

3. To open Device Manager, click the Start button, type mmc devmgmt.msc in the Start search box, and then press Enter.

4. If the User Account Control dialog box appears, make sure that the action that you want to perform is displayed, and then click Continue.

Device Manager starts and displays a tree that represents all the devices that are detected on your computer. Your computer name appears next to the node at the top of the tree. The following nodes represent various categories of hardware, and your computer devices are categorized into these nodes.

5. Double-click Disk drive to open the list.

6. Right-click the entry for the USB storage drive, and then click Properties.

The Device Properties dialog box appears.

7. Click the Details tab.

8. In the Properties list, click Hardware Id.

Under Value, record the string that is displayed.

Note: You can copy these strings to the Clipboard by highlighting the text and pressing CTRL-C. Because many hardware IDs have multiple underscore characters, it is useful to copy them to a text file, which you can paste from a text file when you must specify an identifier. This approach greatly reduces the likelihood that you must add a specific identifier to a list of approved or banned devices.