Restrict USB write using Group Policy

[SteveHodd.hotmail.com]

Restrict USB device write using Group Policy

I'm using "Group Policy Object Editor" on a Windows 2003 DC.

I've checked several newsgroup posts, that ask this question and I've tried
to create an .adm file:

*************************
CLASS MACHINE

CATEGORY "USB Storage"

POLICY "Write Protect USB Storage"
KEYNAME "SYSTEM\CurrentControlSet\Control\StorageDevicePolicies"
VALUENAME "WriteProtect"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
END CATEGORY
*******************************

When I load this file into "Group Policy Object Editor", the "USB Storage"
category appears, but the policy "Write Protect USB Storage" does not show,
so I can not set the policy value.

Does anyone know why the policy is not appearing?

Cheers
Steve

[Unknown]

I'm trying to stop write access to USB devices, using group policies. I've
read several newsgroup articles and tried the following .adm file.

***************************
CLASS MACHINE

CATEGORY "USB Storage"

POLICY "Write Protect USB Storage"
KEYNAME "SYSTEM\CurrentControlSet\Control\StorageDevicePolicies"
VALUENAME "WriteProtect"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
END CATEGORY
*****************************

When I load the .adm file, the category "USB Storage" is displayed, but the
policy "Write Protect USB Storage" does not show, so I can't see/set the
value.

Does anyone know why the policy is not displaying.

Cheers
Steve

[Alex Kirillov]

That's because the key that you try to configure with your ADM file is a
"prefference", not a true policy (it's outside approved locations for true
policies). To see it in GPOE, select Administrative templates node and click
View\Filtering... menu item. In the dialog box, clear the "Only show policy
settings that can be fully managed" checkbox.

[Stev...@hotmail.com]

Thanks Alex, that explains alot.

Steve