Locking the usb ports

[Squitty]

I want to let another person use my laptop put not allow them to copy anything from it. I want to block usb ports, cd writer and wireless internet unless I am logged on as administrator.
Can a techie (his mate) get round this protection and how can I keep my usb mouse in use?

[ACtheTROLL]

sounds like this person shouldn't even be allowed into the house

you can do all this ... but it's going to be a lot of work
first password protect your user account
create a new account set to user - password ... whatever

open a command prompt
type secpol.msc
work your way through the options in local policies and name the account in the options you want to deny

remember exclude overrides not included - so rather than not allowing access ... deny access

either righy click my documents | properties | deneral | advanced
tick encrypt all files and folders

or
download and install
truecrypt
http://www.truecrypt.org/
and stash all your files there

[fo3nix]

I'm not sure if you'll be able to disable the USB ports, but keep one open for the mouse.

If you are/were using Linux, you could (I think) just disable the USB module for that session, and they'll stop working. Not sure for Windows or Mac OS X.

As a general rule of thumb: if someone has physical access to a machine, they can do anything to it. So the answer to your question is yes.

[VHG]

If you are so worried about them copying stuff off it dont lend it to them.

If anybody REALLY wanted something off a laptop all they have to do is take the hard disk out of the laptop, put it in an external USB enclosure and they can copy anything off it they like.

I did recently for a friend of mine whose laptop was playing up.

I took the hard disk out, connected it to my laptop, and copied everything off it.

[Squitty]

Thanks for your answers - Maybe a bit more explanation - I want the guy to develop some software I already have on the laptop - I just dont want him to be able to copy the source code somewhere else or be able to issue the software without the activation code module.
Maybe there is another way?

[VHG]

Well you could get him to sign a non-disclosure form, to say he wont use or distribute your software to anyone else.

But this is a problem ALL software development houses have.

If this person really wants to copy your source code he will find a way to do it (ftp, memory stick, CD or DVD writer, network the laptop, even copy and paste to notepad and so on).

You just have to trust the person.

Or write the software in a such a way that you keep control of one small important file, and it wont run without it.

[ACtheTROLL]

agree with vhg

you can limit access to data ... but where there is a will ...

[smith134]

Try this:
> Go to this location > c:\ windows \system32 \drivers\ > > Now right click this file "usbstor.sys"
> Now go to security tab and only allow to administrator to access it. Deny all other users.
> Apply and OK.
For more help:
http://start.itsage.net/disble_usb_perm_1.gif/ disble_usb_perm_1-full.gif

[ACtheTROLL]

This one bugged me ... I see smith has actially made half a good fist at this one - but it looks like it will take it out for everybody

the microsoft site has two links that should give you better control

http://support.microsoft.com/kb/823732

http://support.microsoft.com/kb/555324

[ChuckFickens]

Easiest way I have found to disable USB ports for data storage (will still leave everything else working) is this

http://www.intelliadmin.com/NetworkAdministrat or.htm

just tell it your computers name (or IP address) select dissable USB mass storage from the drop down list and give it the administrator username and password if not already logged in as administrator.