This way the "intruder" would probably need to bypass a couple of "layers" instead of just one. With the appropriate MPT you can customize Vid, PId, Device ID and serial, so that you create a "unique" set of "authorized" sticks. by serial once installed the authorized ones by serial by DeviceID by Vid/PId Personally, I would TRY getting the Mass Production Tool for the "authorized" sticks and combine the solutions based on several ways: (I have NO idea how much secure this approach is).
#Usb block serial number install
The "common" solution is a service running in the background, AFAIK, BUT you can use another approach, preventing installation of drivers:īasically you install all "authorized" devices, then you "lock" the install of any further device. I don' t think that you can get a "by serial" limitation through GPO or Registry, see this: IF the thing is done for some "serious" security reason, you might want/need to also look in the WPD classes. Yep, that was with the intent of disambiguating, as often happens the MS guys are using the same term to completely different concepts.Īdditionally I presume you are not blocking "USB Removable" you are blocking ALL Mass Storage devices belonging to the "Removable class" (i.e.also Firewire). Edited Januby mchipserĮDIT: The GP we are using blocks, from what i can tell, all USB drives fixed or removable. Is there a better way to do this, and allow certain removable storage drives?ĮDIT: The GP we are using blocks, from what i can tell, all USB drives fixed or removable. We are currently blocking via localGP via the Removable Storage Access.
What exactly do you mean by "Removable" devices (most if not all USB stick controllers are set in factory as Removable but the bit can be "flipped" and you can have for a very large number of models/brands/controllers a USB stick set as "Fixed" - just like a USB hard disk normally is).
HOW exactly you have (currently) blocled *all* "removable" USB storage devices? The Vid and Pid on the contrary, besides same "brand" has often and still are misused, some brand will have their own Vid, some will use the generic Vid of the maker of the controller.Ī number of "brands" will additionally use te same Pid for very different models. The USB specs do impose a serial on any USB mass storage device (controller) and actually I would say 99.99% sticks I have ever seen do sport - from factory - such a serial number. It would be nice to allow items based on serial since that is different per flash drive or any removable media. I was hoping i could do this by Hardware ID, but it appears if I have two thumb drives of the same brand both items will work since they share the same Hardware ID.
I am attempting to block all removable USB storage devices, which is complete, but I am trying to allow certain devices to be installed.
0 kommentar(er)
