Member Avatar for spowel4

I need to disable cd-rom and usb drive access for certain users, via a batch file or something similar so that it can be scripted/automated. Any suggestions on how to do this?

  • 5 Contributors
  • 4 Replies
  • 1K Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by shdwmage

Dani AI

Generated

A concise, scriptable plan that complements the answers above (, , ): for automation there are three practical approaches—machine-wide driver blocking, programmatic device disable, or per-user registry policy edits. Group Policy in a domain (or a per-user local GPO) is the cleanest enterprise solution, but if a script/batch toggle is required the two most reliable options are (A) flip the driver Start value in HKLM so Windows will not load the storage driver, or (B) use a device-management tool to disable the device immediately. A per-user registry-hive edit can hide drives in Explorer for specific accounts, but that only hides the UI and is not a security boundary. See Microsoft documentation for each method below.

Example batch (run elevated — changes usually require reboot):

:: disable USB storage (prevents usbstor.sys from loading on next boot)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f

:: disable CD-ROM driver (may require reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Cdrom" /v Start /t REG_DWORD /d 4 /f

:: re-enable (example)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 3 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Cdrom" /v Start /t REG_DWORD /d 1 /f

Per-user (hide drive icon for a specific profile — not a secure block):

reg load HKU\Target C:\Users\targetuser\NTUSER.DAT
reg add "HKU\Target\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 16 /f
reg unload HKU\Target

Notes and cautions: registry Start changes are machine-wide and require admin rights and usually a restart; use a test VM and keep a recovery plan (Safe Mode or registry backup). Hiding with NoDrives only removes the icon — it does not prevent command-line or programmatic access. DevCon (or the modern pnputil/device commands) can disable devices immediately but require admin tools and care. Authoritative references: Microsoft on disabling USB storage via the UsbStor Start value (https://support.microsoft.com/en-us/topic/how-can-i-prevent-users-from-connecting-to-a-usb-storage-device-460ef516-8ac8-07af-e90b-0d9ac55bcd4d), Group Policy/driver-disable ADMs (https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/adm-template-disable-drivers), DevCon examples (https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon-examples), NoDrives/Explorer policy behavior (https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-windowsexplorer), and reg load usage (https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-load).

Recommended Answers

All 4 Replies

Member Avatar for lincoln68504

Generally that is a setting that actually disables on the computer rather than an end user. My suggestion would be to set up a guest account on the computer and disable those ports for that account. And when you are on the computer, you being the Admin, you can re-enable those.

Member Avatar for sebastianedu

If you want to change this setting in same pc ,Then go to the security tab and change the permission .If you want to change the permission on network pc then use server window and change the permission .

Member Avatar for cuzintone

Usually, this is done in a domain, but basically you would create a group policy to disable removable storage. I'll have to check my machine at home (I'm at work now) to see if there is a local policy to disable removable storage.

Update: I checked at this site - http://blog.dreamcss.com/tech/disable-access-to-removable-storage-devices-in-windows-7/ it it MAY be possible to do via Local Group Policy Editor.

Edited by cuzintone because: more info
Member Avatar for shdwmage

You can edit local group policy for a specific user group. You will need to setup a unique local user group for these users.

Here are instructions to access group policy for a specific usergroup:
http://superuser.com/questions/134066/how-to-apply-group-policy-settings-to-specific-local-accounts-in-windows

Short Version:
1. Start -> Run -> mmc
2. File -> Add/Remove Snap-in
3. Scroll Down the list on the left hand side and find Group Policy Object
4. Select Group Policy Object and hit add
5. Click Browse when the box pops up
6. Click the Users tab at the top of the box
7. Select the user you wish to configure
8. Click OK
9. Click Finish
10. Click OK
11. Click File -> Save As
12. Name the file something useful like "Tom's Group Policy Preferences"
13. Click Save

Now you should be able to quickly load this by going into your administrative tools folder and clicking on the "Tom's Group Policy Preferences" icon.

Important: Do not applying the settings the administrator account.

Here is an article with all of the settings, and where they are located.

For those that don't want to read the article they are located at:
Computer Configuration -> Administrative Templates -> System -> Removable Storage Access

Edited by shdwmage because: Added more info
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.