Restricting drives

LizBlake

Posts: 10   +0
Hi,

does anyone know how to restrict drives in a LUA account? I don't want my kids to be able to see the CD-ROM drive.
 
Well - that's the sort of thing that's passed down at the Domain level via group policies.

http://support.microsoft.com/kb/231289

Might help you - but you are starting to get into a level of detail that is generally reserved for technicians familiar with software and group policies.

Easier solution is just remove the CD drive\get an external one and keep it locked up.

EDIT: Also use that link at your own discretion. From your other posts it seems like you have a Win7 PC and that solution is for Winxp. Either way it's a really hypertechnical solution to the perceived problem. Is there something specific you are trying to keep the children away from that they might get on the CDs? Your bigger worry is the Internet. You can control what physical CDs they have access to - that's probably going to end up as the least of your worries.
 
Re: block the kids access to the CD/DVD drive

You can do it with Windows but, as far as i know, only at the system level: Use Device Manager. Right click the internal CD/DVD drive, select Disable.
> This would block EVERYONE access to the internal CD/DVD drive. You'd have to re-enable it for your own use then disable it again when you're done.

BUT!.... But this only locks out the internal CD drive. It doesn't stop a sneaky kid who brings a USB CD/DVD drive in under their jacket :suspiciou. You'd also want to block all USB storage devices from connecting to the computers' USB ports (this would include USB CD/DVD drives, USB memory sticks, flash drives and hard drives). Non-storage USB devices (like mouse and keyboard) will still work.

Here's how to block connections of USB storage devices at the System level (so you'd have to disable/enable it as needed for your own use ). USBSTOR is the name of the USB Storage device driver. If you disable USBSTOR, you block any USB storage devices from connecting

I suggest using a tool rather then doing a registry hack to change driver's StartupType. Download Serviwin.
> Click View->Drivers. Scroll to usbstor
> Right click usbstor, select Change Startup Type to Disabled

Now, USB storage devices can't connect to the computer. When you want to allow connecting USB Storage devices again, right click usbstor and select Change Startup Type to Manual
 
You may also want to try a local policy by running gpedit.msc and looking here:
Block_CD.png

Same limitations LA said, but if you do it at a user level and use xcacls to block admins from receiving that policy then that gets around that too. This can get messy and confusing though.
 
Got an idea

I Like the external CD-ROM drive idea. I also found out that there are physical USB locks (that you plug in). I'm not too comfortable with the Group Policy stuff, but will ask my friend at work if he can help me.

Thanks again!!!!!
 
just background; the ***/home systems don't honor policies, but xxx/pro systems do :)
 
Back