How to restrict USB port from data storage device on Win2000/XP

[ContinuousLearning]

Like to find out how I can restrict user from plugging any USB device onto any workstation's USB Port running Windows 2000 Professional or Windows XP Professional. Do not want unauthorize leak of information copied out of the computer especially with USB thumb drive type of device so readily available and so much more powerful than a floppy drive. Some of these computer only takes USB mouse and USB keyboard and other uses regular PS/2 mouse and PS/2 keyboard.

It is like the newly released movie "RECRUIT". How do you prevent data being copied out of the computer system.

 

[Jontmke]

Good Question! With the advances in Technology we are always trying to catch up with security. I do not recall any policy restrictions for USB. The only thing I can think of is to physically unplug the port from the motherboard.
Wait, there is a policy to show drives, and you can block a drive from showing up in my computer. So, maybe if you block all other drive letters other than the ones you need maybe they won't be able to see the device when they plug it in.

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)

 

[ContinuousLearning]

How do you block a drive from showing up in the computer?

 

[dkriese]

Diasble it in device manager, disable this device USB Root HUB

 

[Jontmke]

Tweakui has a page to hide or show drives. Disabling the Hub in Device manager is a good idea.

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)

 

[comtec17]

You can also go into your BIOS and disable this feature. Set up a management password to get into BIOS and users will not be able to access it.

 

[RobG2001]

You might want to disable the Plug N Play service. I've done this myself and works well.

 

[Turkbear]

But, If someone can get to your workstation and access it without your knowledge, any security you set up is defeatable ( worst case , they just steal your hard drives place them in their system, read the data, put them back - or take the whole workstation)