USB Storage or Just USB

[CT2600]

I found this article on how to disable USB storage on a Windows XP (Home/Pro) System. However, I don't know if the question has been asked here or mentioned else where, but what security features are available for Win (NT/2K) Systems?

I would like to know if there are any methods to just restrict USB Storage and or methods to disable complete usage of the USB and/or is you can actually assign permissions to the USB ports. I think the latter would be of best interests to all.

[Status]

Someone correct me if im wrong but i believe that you can only set permissions on the applications USING the usb port and not the port itself. For example in that article it says you can set permission on usbstor.* files. And in severe cases, just break the port .

[CT2600]

Yes, but that is WinXP specific. I am looking for information regarding NT/2K mostly 2K since we are almost fully updated.

[Status]

http://is-it-true.org/nt/nt2000/atips/atips41.shtml

That site says that you must be an admin to plug in a USB device, so if you want to use them you must be an admin, which is a pretty big security risk since if you want to use them all around a company or something since EVERYONE would have to have admin accounts, im not too sure about the truth factor on this as it seems kind of farfetched to me.

http://www.wown.info/j_helmig/w2kpolic.htm

This says:

Here you find the list of rights/privileges for all the jobs on your system, from:
- Accessing this computer from the Network
- Backup files and directories
- Restore files and directories (yes, it is a different right/privilege)
- Load and unload device drivers --> Configure hardware, reserved for Administrators.

Load and unload device drivers --> Configure hardware, reserved for Administrators

Well i guess that kind of pertains to your question as usb can fall under that, so im guessing admin is needed to use the usb, other than that i cant really find much.

Edit:

http://www.protect-me.com/dl/download.html

Device lock lets you set permissions for users trying to use the usb port and many other things. I believe theres some sort of downloadable trial version, but you have to buy the full version, some sort of method that a lot of companies use.

DeviceLock for Windows NT/2000/XP and Windows Server 2003 gives network administrators control over which users can access what devices (floppies, USB, FireWire, serial and parallel ports, Magneto-Optical disks, CD-ROMs, WiFi and Bluetooth adapters, infrared ports, ZIPs, etc.) on a local computer. Once DeviceLock is installed, administrators can control access to floppies, CD-ROMs or any other device, depending on the time of day and day of the week. DeviceLock enhances access control for Windows System Administrators and helps control removable disk usage. It can protect network and local computers against viruses, trojans and other malicious programs often injected from removable disks. Network administrators can also use DeviceLock to flush a storage device's buffers.

[rjhaey]

Disable the usb hardware from the device manager and/or bios that's all it is...

If u want to truly disable the port...

Watch your thoughts, for they become words. Choose your words, for they become acions. Understand your actions, for they become habits. Study your habits, for they become your character. Develop your character, for it becomes your destiny...

[Modderfokker]

rjhaey:

firstly: every post i see you do HAS to be in bold or big letters, settle down people will still read your post if it doesnt stick out like dogs balls.

and second: If disable the usb in the device manager, then what if you need to use it later on but dont want to go through the install blah blah, i want (like the author) to know if customized permissions based on groups or users are possible.

[Status]

Read my post

[nihil]

Hi,

what security features are available for Win (NT/2K)

NT is not a problem, it does not support USB at all

That possibly explains why there is so much 98/Me still around for people who want to use USB game controllers & such, and cannot upgrade to NT

Cheers

[CT2600]

Great information guys, I'm in the middle of testing out some of the things you informed me of, in order to see which one best suites my needs. Thanks again.