Member Avatar for harmeet

Hi All,

I am running a W2k Domain and i want to know that is this possible that we can disable CD-ROM drive on all clients (member) through Group Policy in windows 2000. If yes please let me know that which option to select under MMC snap-in to implement this functionatlity.

Thanks :rolleyes:

  • 3 Contributors
  • 3 Replies
  • 381 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by sandi_p14

Dani AI

Generated

Short answer: yes — but there are two very different approaches and they behave differently. As suggested, start with Group Policy; as found, Windows has built‑in GPO settings that restrict or hide drive access in Explorer. Those UI/hide policies only block access through Windows Explorer and dialogs — they do not stop programs or services from reading a CD. Using Group Policy to hide specified drives (notes & limitations). (learn.microsoft.com)

If the requirement is to stop all access to CD media, the reliable method is to prevent the CD driver from loading (change the cdrom service Start value in the registry). Microsoft documents the registry/service approach and provides an ADM template you can import into a GPO to set the driver start value centrally (this is the safest way to enforce “no CD” at the OS level). Read the ADM-template guidance before rolling out — the template will “tattoo” client registries. [Microsoft: ADM template to disable drivers].(https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/adm-template-disable-drivers). (learn.microsoft.com) (learn.microsoft.com)

A pragmatic deployment on a W2K domain is a computer startup script (GPO -> Computer startup scripts) that runs a single reg command to set the Cdrom Start value to Disabled, then reboots. Example (run as admin via startup script):

reg add "HKLM\SYSTEM\CurrentControlSet\Services\Cdrom" /v Start /t REG_DWORD /d 4 /f

The reg.exe syntax is documented by Microsoft; startup scripts are applied under Computer Configuration -> Windows Settings -> Scripts (Startup). After the change a reboot is required for the driver to stop loading. [reg add reference] (https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742162%28v%3Dws.11%29). (learn.microsoft.com)

Do not apply domain‑wide without testing: export the current Start value first, test on a pilot OU, document a rollback (restore the saved value or remove the ADM/script), and remember BIOS disable or physical removal is the most tamper‑resistant option if security is critical. (learn.microsoft.com)

Recommended Answers

All 3 Replies

Member Avatar for rasputinj

You would have to look for it under Edit GPO, in Users and Computers, right click on the OU that the members are in are look around. I do not remember a GPO setting for CD-Rom, but that is the place to start. If not I think you would have to set local policy on the clients.

Member Avatar for harmeet

You would have to look for it under Edit GPO, in Users and Computers, right click on the OU that the members are in are look around. I do not remember a GPO setting for CD-Rom, but that is the place to start. If not I think you would have to set local policy on the clients.

I want to implement through GPO and if i want to do the same with client policy....then i prefer to go for disable the CD-ROM from BIOS or unplugged it.

Unable to find the option as suggested by u.

Thanks

Member Avatar for sandi_p14

Hi All,

I am running a W2k Domain and i want to know that is this possible that we can disable CD-ROM drive on all clients (member) through Group Policy in windows 2000. If yes please let me know that which option to select under MMC snap-in to implement this functionatlity.

Thanks :rolleyes:

hi .....
select the OU (which contain users) for which u want to disable CD-ROM , right click-->
group policy--> edit--> computer configuration -->windows setting --> security setting -->
local policies --> security options --> device : restrict CD:ROM (PROPERTIES )--> Enable

mmc- -- > file--> aad/remove snap in --> add --> group policy object editor -->close -->
then follow the above procedure..

this will work..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.