This document will explain the following:
The Secure USB configuration is used for both users and computers to block or unblock the use of the USB devices.
Using this configuration, you can block or unblock the following devices:
Mouse
Disk drives (for example, USB drives and external hard-disk drives)
CD ROMs
Portable devices (for example, mobile phones, digital cameras and portable media players)
Floppy disks
Bluetooth devices
Images (for example, USB cameras and scanners)
Printers
Modems
Apple USB devices (for example: iPhone, iPad and iPod touch)
You can also exclude devices using the Vendor ID or Device Instance ID assigned to each device.
When you apply the Secure USB configuration to both computers and users, the settings made for computers will be applied before the settings made for users. For example, assume that you have made the following settings:
Settings configured for users
Administrator: You have unblocked the usage of the disk drive
Other users (excluding the administrator): You have not deployed any configurations
Settings configured for computers : You have blocked the usage of portable devices and disk drives
The following actions will take place:
Computer startup: The Secure USB configuration settings made for the computer are applied when the computer is started. This means that no portable devices and disk drives can be used.
Administrator logon: The Secure USB configuration for the computer is applied. However, it is over written by the settings made for the administrator. This means that the administrator can use disk drives.
Other users (excluding the administrator) log on: The Secure USB configuration made for the computer is applied.
Other users (excluding the administrator)log off: The log off action settings made for users are applied when a user logs off. If the log off-action setting is set to Don't alter device status, then the settings made will apply to the next user who logs on, provided that the user does not have any settings that apply to them.
|
|
Note: Block USB, represents to block the access to use any USB device. |
As an administrator, you can create a configuration block or unblock specific USB devices. You can also exclude specific devices, if required.
To create a configuration to secure USB devices for users, follow the steps given below:
Navigate to Configurations tab and choose Secure USB from the list of Windows configurations.
Enter a name and description for the configuration
Click Add to apply restrictions
To add restrictions, select the devices, choose to block or unblock devices. When you have chosen to block devices, you can also specify the devices which needs to be excluded.
Specify the required execution settings
Click Deploy
You have created configurations to secure USB devices. These configurations will be applied when the user logs in to the computer.
When you block a device you can exclude certain devices from being blocked. This can be done, by using Vendor ID or the Device Instance ID assigned to each device. You can exclude devices only when you have blocked a device. To exclude devices, follow the steps given below:
Click the Exclude Devices link against a device
You can also choose to block all the devices, from the specified vendor. You will have to specify the Device Instance ID using which, the product will fetch the vendor instance ID and exclude all devices from the specific vendor.
You can choose to exclude All Encrypted devices/encrypted devices from the list of specified devices. Devices that are encrypted using BitLocker can be added to the exclusion list.
Click Close
You have excluded a device from being blocked.
Every USB device has a unique ID. This ID is assigned to devices by the system to identify them easily. You can identify the Device Instance ID of a Device by following the steps mentioned below:
Right click on My Computer
Click on Properties
Click on Device Manager (Refer to the figure below)
From the list of devices, expand the list of devices for which you want the Device Instance ID.
(For example : if you want to identify the Device Instance ID of a mobile phone that you have connected to the computer, expand portable devices and follow the next step.)
Right-click on the name of a specific device and click Properties (Refer to the figure below)
Figure 2: Properties
Click the Details tab
In the drop-down box, select Device Instance ID or Device Instance Path (Refer to the figure below)
Figure 3: Device Instance ID
|
|
In computers which have the operating system Windows Vista (and later versions), the Device Instance ID is called the Device Instance Path. You can copy the Device Instance Path from the Properties property sheet of the Device Manager.
|
You can now view and copy the Device Instance ID for a specific device.
Administrators can choose to revoke all USB related restrictions which are applied to the computer.
To create a configuration, in order to revoke all USB related restrictions for users, follow the steps given below:
Navigate to Configurations tab and choose Secure USB configuration from the list of Windows configurations.
Enter a name and description for the configuration.
Click Remove to revoke all restrictions applied to the computer.
Make the required execution settings.
Click Deploy.
You have created configurations to secure USB devices. These configurations will be applied when the user logs in to the computer.
