Remove USB Pen drive?

[BOFH1]

My users cannot remove USB devices inc Pen drives, i tried setting this policy but still no joy,

Computer Configuration\Windows Settings\Security Settings\Local Policies\security options\Devices: allowed to format and eject removable media

I emabled interactive users to do this but they still can't. (Obviously they can just pull them out which is what they are doing but i don't like that)

Win2k Pro SP4

Any ideas.

Thanks.

 

[bcastner]

Your GPO is not sufficient for Pen Drives. The USB Pen Drives are enumerated under the PnP service; changing your floppy disk and inserting another is not, for example.

There really is no good GPO for Pen Devices at the moment under Win2k or XP.

Let them remove them as they are doing.

 

[BOFH1]

Hmmm a few users have complained this is corrupting docs, i've not seen any evidence of this yet tho.


Thanks for the reply tho.

 

[bcastner]

It is perfectly believable that it could corrupt documents if removed in an unsafe manner.

Have them logoff before removing the device.

 

[BOFH1]

I will cheers.

ps i assumed the "format and eject removable media" meant other than floppy disks.

Did i interperit that incorrectly.

 

[bcastner]

Yes, you interpreted the policy object correctly.

Strictly speaking that policy object was designed for NTFS formatted media only; what was in mind was MO (magneto-optical) drives.

It is tied to a Windows service called RMS (Removable Media Storage System) that handles among other things tape libraries.

There just is not a suitable policy object in the standard MMC libraries for USB Pen devices. Unfortunately, handling these devices "properly" implies some changes in the way in which Plug and Play enumeration occurs, and how the devices are identified to the OS.

 

[BOFH1]

Of course i hadn't considered RMS.

Thanks for your input bcastner.

 

[bcastner]

The issue appears in all of the OS Forums on this, and other sites.

I am very sympathetic, and in my own modest way have "pushed" the issue with Microsoft.

There are things in the works; the convenience of these little devices far exceeds the planned for security hazards of floppy disks and CDs.

As a guess, you will see first standards set for identifying the devices unambiguously (there essentially are none now), and a resultant GPO to handle the issue.

As another guess, the security issues will rate first on the Microsoft list. The standards setting for acceptable HCL devices to incorporate the safety removal icon a bit later.

And whether Win2k will ever see these changes, I am flat clueless.

There exists already some third-party software to handle your issue. One good example:

http://www.gotpackets.com/rdd/rddindex.htm

 

[looka]

do you mean users cannot disable usb devices right clicking on the tray icon? did you try a left click too?