☰

使用特定用户的 Active Directory 启用/禁用 Windows 上的 USB 设备

tag-icon • tag-icon windows security active-directory usb
使用特定用户的 Active Directory 启用/禁用 Windows 上的 USB 设备

出于信息泄露的原因，我被要求禁用 Windows 机器上对 USB 设备的访问。

虽然这可以通过 Active Directory 来实现，但问题在于解决方案应该让我们在有限的授权期限内为某些用户启用访问权限。

如何使用 Active Directory 来实现这一点（如果可能的话）？

如果没有的话，我可以使用哪个软件来实现？

答案1

您说的设置是应用于计算机而不是用户的。如果您不介意将其应用于计算机，您可以创建一个安全组并将不应“受限制”的计算机放入其中。修改您应用这些限制的组策略对象的权限，以包括您创建的计算机组的“拒绝应用组策略”，这样设置将不再适用于这些计算机。您可以根据需要将计算机移入或移出组，但我相当肯定，您必须重新启动计算机才能使限制和非限制的更改生效。

答案2

据我所知，环氧树脂是解决这一问题的一种非常流行的方法。

如何防止用户使用绕过安全措施的 USB 驱动器

以太网、USB、电话等的物理端口锁？

但实际上，GP 看起来是最好的答案：

http://windowsdevcenter.com/pub/a/windows/2005/11/15/disabling-usb-storage-with-group-policy.html

答案3

我在上一家公司设置了 ADM，并将 GP 设置为某些组。启用大容量存储和禁用大容量存储。如果组发生变化，则需要重新启动。这是一个注册表更改，基本上可以禁用 USB 大容量存储驱动程序。

这是我使用的 ADM。几年前从 Google 上获取的。

CLASS MACHINE
CATEGORY !!category
 CATEGORY !!categoryname
  POLICY !!policynameusb
   KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR"
   EXPLAIN !!explaintextusb
     PART !!labeltextusb DROPDOWNLIST REQUIRED

       VALUENAME "Start"
       ITEMLIST
        NAME !!Disabled VALUE NUMERIC 3 DEFAULT
        NAME !!Enabled VALUE NUMERIC 4
       END ITEMLIST
     END PART
   END POLICY
  POLICY !!policynamecd
   KEYNAME "SYSTEM\CurrentControlSet\Services\Cdrom"
   EXPLAIN !!explaintextcd
     PART !!labeltextcd DROPDOWNLIST REQUIRED

       VALUENAME "Start"
       ITEMLIST
        NAME !!Disabled VALUE NUMERIC 1 DEFAULT
        NAME !!Enabled VALUE NUMERIC 4
       END ITEMLIST
     END PART
   END POLICY
  POLICY !!policynameflpy
   KEYNAME "SYSTEM\CurrentControlSet\Services\Flpydisk"
   EXPLAIN !!explaintextflpy
     PART !!labeltextflpy DROPDOWNLIST REQUIRED

       VALUENAME "Start"
       ITEMLIST
        NAME !!Disabled VALUE NUMERIC 3 DEFAULT
        NAME !!Enabled VALUE NUMERIC 4
       END ITEMLIST
     END PART
   END POLICY
  POLICY !!policynamels120
   KEYNAME "SYSTEM\CurrentControlSet\Services\Sfloppy"
   EXPLAIN !!explaintextls120
     PART !!labeltextls120 DROPDOWNLIST REQUIRED

       VALUENAME "Start"
       ITEMLIST
        NAME !!Disabled VALUE NUMERIC 3 DEFAULT
        NAME !!Enabled VALUE NUMERIC 4
       END ITEMLIST
     END PART
   END POLICY
 END CATEGORY
END CATEGORY

[strings]
category="Custom Policy Settings"
categoryname="Restrict Drives"
policynameusb="Disable USB Removable Drives"
policynamecd="Disable CD-ROM"
policynameflpy="Disable Floppy"
policynamels120="Disable High Capacity Floppy"
explaintextusb="Disables the USB Removable Drives capability by disabling the usbstor.sys driver. \n\nSelect the ENABLED radiobox, then select STOPPED for the usbstore.sys driver status in the drop-down list.  \n\nNote that this will only prevent usage of newly plugged-in USB Removable Drives or Flash Drives, devices that were plugged-in while this option was not configured will continue to function normally. Also, devices that use the same device or hardware ID (for example - 2 identical Flash Disks made by the same manufacturer) will still function if one of them was plugged-in prior to the configuration of this setting. In order to successfully block them you will need to make sure no USB Removable Drive is plugged-in while you set this option. \n\nIn order to re-enable the usage of USB Removable Drives select STARTED for the usbstore.sys driver status in the drop-down list."
explaintextcd="Disables the CD-ROM Drive by disabling the cdrom.sys driver. \n\nSelect the ENABLED radiobox, then select STOPPED for the cdrom.sys driver status in the drop-down list. \n\nIn order to re-enable the usage of USB Removable Drives select STARTED for the cdrom.sys driver status in the drop-down list."
explaintextflpy="Disables the Floppy Drive by disabling the flpydisk.sys driver. \n\nSelect the ENABLED radiobox, then select STOPPED for the flpydisk.sys driver status in the drop-down list. \n\nIn order to re-enable the usage of USB Removable Drives select STARTED for the flpydisk.sys driver status in the drop-down list."
explaintextls120="Disables the High Capacity Floppy Drive by disabling the sfloppy.sys driver. \n\nSelect the ENABLED radiobox, then select STOPPED for the sfloppy.sys driver status in the drop-down list. \n\nIn order to re-enable the usage of USB Removable Drives select STARTED for the sfloppy.sys driver status in the drop-down list."
labeltextusb="usbstore.sys driver status"
labeltextcd="cdrom.sys driver status"
labeltextflpy="flpydisk.sys driver status"
labeltextls120="sfloppy.sys driver status"
Enabled="Stopped"
Disabled="Started"

答案4

如果在 Windows7 中使用 Gpedit 禁用 USB 大容量存储设备

  1. 重置 gpedit 配置设置所有可移动存储类别：拒绝所有未配置的访问
  2. 然后 Gpupdate
  3. 驱动程序安装
    设备管理器->更新驱动程序->浏览：c->windows->inf->usbsstore.disabled（将usbstore.disabled重命名为usbstore.inf然后选择usbstore.inf）->下一步完成
  4. 重启机器

相关内容