Disabling removable USB storage - W32

I had someone come to me looking to disable USB storage devices while at the same time, leaving them active for I/O devices like a mouse, CDROM, etc. Of course the goal is to stop people from walking up to a workstation and making off with classified information.

I did find a solution to this and I thought that it was useful enough to pass along to others.

Have a look at how easy it is.

Just open regedit and browse to this key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

Look for the 'Start' key.

Switch this value to 4, and USB storage devices are disabled.

Switch this value to 3, and USB storage devices are enabled (this is the value by default).

This stops the USB storage drivers from loading when the OS boots up. It's a nice little security feature that is easy to distribute across the enterprise as well. Note that this *only* impacts removable storage, no other USB devices. Pretty kewl huh?

;)

--TH13

Very kewl Mr Horse :)

I didnt think you could do that with out disabling all the usb devices

Great tip

MLF

Yeah man, when I heard the requirement I was ready to say, "Nope, Windows isn't smart enough to deal with this..." but I researched it anyway. Needless to say I was surprised that MS thought about this and second, I was surprised that such a simple change actually worked.

Pass it on man. This is my new favorite reg hack, replacing the SYN flood protection reg hack as #1.

--TH13

Good find. However, without a genital Reg hack, that's not a man you're talking to ;)

I've toyed with the registry before just because I wanted to see what you could do. I think you were talking to me while I did it and I said I was a changed man fater that and I was. I managed to make AIM allow more than 200 buddies on my buddy list with a simple hack I did, I should boot up my Windows box and see if I can remember where it was that I did it. It was really easy and gave me 300 buddies.

Maybe we should make a Registry hack thread and put all our little hacks in them for people to search through. I have another one I think for Windows 98 that pops up the CD Key in case yuo lose it somewhere around here.

LOL.

I'm writing an article on handy reg hacks that will be published later this month.

--TH13

There is another way to do it too, along with your reg hack.

http://support.microsoft.com/kb/823732

So, you could allow some while restricting others.

How does it react to devices like digital cameras, cell phones, mp3 players, or PDAs that have utilities to access the removable media? The user would have to have permission to install the utilitiy, but just curious if it disables those devices too?

Anything that uses the removable media drivers will fail.

For instance, I have a digital camera that has the ability to appear as a disk drive when mounted. When I set that option, the host would not mount the device.

I'm going to test my daughter's SanDisk MP3 player this evening. I'll let ya know how it goes.

--Th13

I mentioned this last year and the thread below gives a different twist on this subject:

http://www.antionline.com/showthread...ht=disable+usb

It makes USB devices readable but not writeable.

Quote:

---

Originally posted here by thehorse13
LOL.

I'm writing an article on handy reg hacks that will be published later this month.

--TH13

---

Wanna leak any teasers? ;)


BTW, useful hack.

Nah, but I will tell you that these reg hacks are pretty damn useful. You will be able to find the article on enterpriseITplanet.com under features>security at the end of this month.

--TH13