How to control USB ports and CD/DVD drive?

[morland]

Hi,

In a LAN environment (Windows 2003 as the server O/S and Windows XP and the O/S on client machines) how can we control/limit the use of USB ports and CD/DVD drives? Do we need to use some software for this or are their built-in features etc. (like the concept of Administrator, and Group policies, etc.) that can be used to achieve this?

The one problem that I can think of is that if USB ports are locked/blocked then how will users be able to use their mouse and keyboards? The reason to control/limit use of USB ports is so that someone might not plug-in a USB stick and either introduce virus into the LAN or copy important and sensitive files. I know that they can easily email the files to someone but the idea is to minimize the risks even though they cannot be totally controlled. We also want to control the use CD drives so that users can not i) Burn data on CD's and ii) install software on their own

Will appreciate some good and simple solution (if one exists).

Thanks

[MrJinje]

You want a USB security software, if you google their are plenty to choose from. I haven't used any of them, but this one looks good to me.

http://www.myusbonly.com/usb-security-devi...ntrol/index.php

[nitroshift]

Is your 2003 server a domain controller? If yes, you can use the group policy features in it and restrict access to cd-rom's to locally logged-on users only and prevent user's installation of drivers for the USB drives. Done it myself in quite a big environment (64 servers and over 5000 workstations) and it works like a charm. Mind you, if there are installed any USB drives so far, you will have to manually uninstall them prior to aplying the policy. As for burning CD's, you will find in group policy editor a policy that removes the burning option for cd-rom's too Hope that helps.

[morland]

Thanks MrJinje and nitropuppy for your replies.

Yes the domain controller is Windows 2003. Thanks for the tip/clue. Will bother you if I get stuck with the group policy thing.

[nitroshift]

Thanks MrJinje and nitropuppy for your replies.

Yes the domain controller is Windows 2003. Thanks for the tip/clue. Will bother you if I get stuck with the group policy thing.

No problem at all That's why we are THE forum when it comes down to microsoft software