Disable USB Mass Storage Device(s)

[jordi2k]

Hypothetically speaking, if you wanted to disable the ability to connect a 'USB Mass Storage Device' e.g. Portable external hard drive or more specifically a USB Keyring type Drive but still leave the USB port(s) fully functional for all other types of device (keyboard, mouse, hub etc), how would one set about it?

OS is Windows XP Professional
USB can be either 1.1 or 2.0, bears no relevance.

I am already aware of the CACLS function to remove permissions of the INF's, just curious as to another way; preferably without the use of third-party software / hardware.

Thanks!

[Ethel]

Is this any use?

http://support.microsoft.com/kb/823732

[jordi2k]

Similar to what I already had in mind, but this would rely on having the appropriate priviledge to access the 'Security' tab on a files properties. But thanks for the link.

In truth the point to my question was to know how to disable access in order to work backwards and enable it again.. The company I work for takes a dissaproving view of USB Pen Drives but yet also won't give me network access on my Laptop, so its very hard to transfer files!!

They're issuing an update on what I assume is either a Group Policy or ADM file to disable access to Mass Storage Devices, wanted to be prepared to counter just in case!!

... any other suggestions?

[Ethel]

It's going to become more common in the workplace - it's just too easy for disgruntled employees to download the databases and sell the info to rival firms - or use it in some other way.

So you want to hack the security. I'm sure there must be a way - I'm equally sure it would be a disciplinary offence if you did and got caught.

All I can suggest is you prepare a good argument for more rights of access.

Good luck.

[jordi2k]

Yeah, it was just something to pass the time.. hypothetically of course.. We'd never intentionally condone the violation of any security policy an organization has put in place..

Plus, in the past its always been useful to point out the weakness of my company's security features.. if I can do it, someone else can do it and mis-use it in all the wrong ways! You'd be suprised how much incentive to keep quiet you get!!

[OBonio]

You could reenable them by using a live Linux CD, but that would require rebooting each time you wanted to use the USB key. Just a thought.