2003 Server and USB 1

[downloadkid]

Ok, I'm sure there must be an answer because I can't believe MS has left such a gaping hole in their system.

I've just completed the roll out from NT4 & W2K to a Server 2003 whole school network. All has gone pretty much to plan...however there appears to be a bit of a large hole in my security stratedgy called USB.
I was absolutely amazed to find that there is nothing in the GPO settings that allows me to control access to USB ports other then locking them down locally via the BIOS.
The problem is that I need to be able to provide teachers with access for their USB keys whilst at the same time on the same machines prevent students uploading pics, mpegs, mp3 into their home folders from their phones / ipods/ memory sticks etc in other words USB mass storage devices.
I am aware that there are third party solutions that can prevent access but before having to go down that road I need to know I have tested all routes.
I have searched the net to no avail, I did actually find a GPO someone had made up which unfortunately didn't work. I even changed the permissions locally on the USB mass storage .INI and DLL files to staff and admin access only, that didn't work either.
Got to say I am soooooo disapointed that MS could overlook such an issue, almost can't believe it hence me asking you peeps because I must be missing some thing?

 

[JoeBloggssss]

Hi,

My company is a Microsoft Gold Partner, this area interested me and I spoke with Microsoft regarding this. There is no real solution without using a third-party application, Windows XP SP2 does include a workaround but is still far to administrative intensive and would not be good foryour situation. Microsoft plans to release this desired fuctionality in LongHorn

http://news.com.com/Longhorn+to+put+squeeze+on+gadgets/2100-1016_3-5356485.html

Hopes this helps alittle.

 

[JoeBloggssss]

http://www.devicelock.com/

 

[chiph]

Here's a suggestion:

http://www.heavydutystore.com/db/customer/product.php?productid=19918&cat=671&page=1

Just fill the students USB ports with it.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[downloadkid]

thanks all, kind of figured that was the case, still peeved about it. The school doesn't have a select agreement / school agreement so will mean a costly upgrade as and when the fabled longhorn goes public.
cheaper option as you have pointed out is devicelock, which I have been looking at. Though there is a side of me that would love to put the silicon chiph has mentioned somewhere unmentionable.......
All said and done it was another MS cock up, cheers chaps for doing half a job and charging twice the price...I am most definately in the wrong game.

 

[schofs]

What we had to do was disable USB at the Bios level

give users who are allowed to USB the bios password not good but free

or if netwoked only allow USB on a machine that is at a place where only teachers have access turn it off on all others


regards

 

[sab4you]

Have you tried this out?

Administrator tools/local security settings (or domain)

expand local policies and user rights.

Then for "Load and Unload Device Drivers" you can select specific groups that can do this. Only select your teachers and admins, but make sure your students are not in this group.

 

[downloadkid]

sab4you, damm good idea, hadn't thought of that or really used that facility....I'll give it a try, not in now till Monday....few days off!!!! I'll keep you posted
cheers

 

[sab4you]

dont forget if you do these policies, you need to give it time to update, or force the update