Disable and enable the usage of USB storage devices

USB storage - a possible security risk?

Decent IT administrators secure their networks behind firewalls. They install mail filters on their SMTP servers and deploy anti-virus software on all client workstations. But securing the network is not sufficient -- what happens if the users bring their own USB memory sticks and connect them to the computers at their office? A 1 Gb USB stick can sometimes hold an entire company's vital data. Within minutes or even seconds an employee has all the files they need in order to start up their own business and take all the customers with them. Alternatively, what happens if a careless user accidentally compromises the network with an infected USB stick?


What does Microsoft have to say about it?

If you, the administrator, want to establish a minimum level of security, it is absolutely necessary to control which users can connect USB memory sticks to a computer. Unfortunately, a default Windows XP or Windows 2000 installation comes with no limitations on who is able to install and use USB storage media. Microsoft knowledge base article 823732 contains instructions on how to disable USB storage access for a certain group of users; however, the article only distinguishes between whether or not a USB storage device has been installed on a particular computer. Furthermore, the instructions are limited to a stand-alone computer. According to the general rule of thumb "If it's tedious, there is a better way", I try to avoid techniques that force me to repeat certain tasks for each computer that I manage. That's what group policy objects (GPO) are for.


To Disable and enable your USB storage device, follow this steps :

* To edit this feature, you will need to be logged into your computer with administrative rights.
* First click on Start button to open "Run" and type "regedit" then press Ok button to open the Registry Editor.

In registry editor locate the given path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR

Here select the "USBSTOR" folder and in right side of the registry editor panel find the value with name "Start".

Double click on "Start" and then set its value 4 under "Value data" section.

Close the Registry editor and restart your computer for changes to apply.

Now when you want to restore the default setting, open the Registry Editor and set its value back to 3.

Now again close the Registry editor and restart your computer for changes to apply.