Usb Storage Device Deny via Group Policy

Dear sir/Madam,

We are using Windows 2003 ent. server with vista and xp clients. For Deny
usb storage device i have make a policy in server. In that policy i have
download the USB_removable_drives_ADM file and add in gpo. than disable usb
storage device. and apply this policy to computers. now all computers have no
access to usb storage. but because of I wants give permit to some computer
for access usb storage, I have create one OU and apply policy than create and
security group make member all computer which i want to deny. but it is not
working. When i move computers in this OU than working also.
and in this case i can apply only one policy that computers.
Please let me know how i can apply this policy without moving computer at
another OU.

Thanks,

Anklesh Chauhan

Hello Anklesh,

GPOs can be applied to computers or users only, not to security groups. So
create a second OU with the same GPOs wihtout USB restrictions and move the
machine to it.

Another option then can help but maybe need some reconfiguration of GPOs,
is to use security filtering according to:
http://technet.microsoft.com/en-us/l...88(WS.10).aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Dear sir/Madam,
>
> We are using Windows 2003 ent. server with vista and xp clients. For
> Deny usb storage device i have make a policy in server. In that policy
> i have download the USB_removable_drives_ADM file and add in gpo. than
> disable usb storage device. and apply this policy to computers. now
> all computers have no access to usb storage. but because of I wants
> give permit to some computer for access usb storage, I have create one
> OU and apply policy than create and security group make member all
> computer which i want to deny. but it is not working. When i move
> computers in this OU than working also. and in this case i can apply
> only one policy that computers. Please let me know how i can apply
> this policy without moving computer at another OU.
>
> Thanks,
>
> Anklesh Chauhan
>

Dear Meinolf,

Thanks a lot for reply.

I have got my solution in your answer.

Anklesh Chauhan.

"Meinolf Weber [MVP-DS]" wrote:

> Hello Anklesh,
>
> GPOs can be applied to computers or users only, not to security groups. So
> create a second OU with the same GPOs wihtout USB restrictions and move the
> machine to it.
>
> Another option then can help but maybe need some reconfiguration of GPOs,
> is to use security filtering according to:
> http://technet.microsoft.com/en-us/l...88(WS.10).aspx
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
> > Dear sir/Madam,
> >
> > We are using Windows 2003 ent. server with vista and xp clients. For
> > Deny usb storage device i have make a policy in server. In that policy
> > i have download the USB_removable_drives_ADM file and add in gpo. than
> > disable usb storage device. and apply this policy to computers. now
> > all computers have no access to usb storage. but because of I wants
> > give permit to some computer for access usb storage, I have create one
> > OU and apply policy than create and security group make member all
> > computer which i want to deny. but it is not working. When i move
> > computers in this OU than working also. and in this case i can apply
> > only one policy that computers. Please let me know how i can apply
> > this policy without moving computer at another OU.
> >
> > Thanks,
> >
> > Anklesh Chauhan
> >
>
>
> .
>

Hi Anklesh,
I?m not sure if you?re still looking for a solution to this issue, but if you are, I recommend downloading the free version of NetWrix USB Blocker. USB Blocker, which is available in freeware and commercial editions, relies on group policy mechanisms to enforce centralized access control of specified USB ports. With NetWrix USB Blocker, you can easily decide what computers to block and what computers not to block, and it will work well for Vista and EX clients. USB Blocker will start working after just a few clicks of the mouse, and I think you will enjoy the simplicity with which it works.

I encourage you to download the NetWrix tool for free at http://www.netwrix.com/usb_blocker_freeware.html

Thanks and good luck Anklesh,
Stephen Schimmel
Product Manager
NetWrix Corporation
(201) 490-8840 Ext. 964



> On Saturday, May 22, 2010 5:41 AM Anklesh Chauhan wrote:

> Dear sir/Madam,
>
> We are using Windows 2003 ent. server with vista and xp clients. For Deny
> usb storage device i have make a policy in server. In that policy i have
> download the USB_removable_drives_ADM file and add in gpo. than disable usb
> storage device. and apply this policy to computers. now all computers have no
> access to usb storage. but because of I wants give permit to some computer
> for access usb storage, I have create one OU and apply policy than create and
> security group make member all computer which i want to deny. but it is not
> working. When i move computers in this OU than working also.
> and in this case i can apply only one policy that computers.
> Please let me know how i can apply this policy without moving computer at
> another OU.
>
> Thanks,
>
> Anklesh Chauhan


>> On Saturday, May 22, 2010 4:15 PM Meinolf Weber [MVP-DS] wrote:

>> Hello Anklesh,
>>
>> GPOs can be applied to computers or users only, not to security groups. So
>> create a second OU with the same GPOs wihtout USB restrictions and move the
>> machine to it.
>>
>> Another option then can help but maybe need some reconfiguration of GPOs,
>> is to use security filtering according to:
>> http://technet.microsoft.com/en-us/l...88(WS.10).aspx
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


>>> On Tuesday, May 25, 2010 12:41 AM Anklesh Chauhan wrote:

>>> Dear Meinolf,
>>>
>>> Thanks a lot for reply.
>>>
>>> I have got my solution in your answer.
>>>
>>> Anklesh Chauhan.
>>>
>>> "Meinolf Weber [MVP-DS]" wrote:


>>> Submitted via EggHeadCafe
>>> Oracle Developer For Beginners
>>> http://www.eggheadcafe.com/training-...L-Samples.aspx