Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 9 down vote favorite
10

I created a limited user account and want to restrict USB and CD drive access using group policy settings. Hence I want to use gpedit.msc to enforce restrictions on the limited account and disable access to USB and CD drive, and prevent the limited account from modifying those changes. How can I achieve this without restricting any other accounts?

share|improve this question

3 Answers

up vote 11 down vote accepted

In Windows Vista and later you can apply policies only to a specific account, but you have to load the group policy object editor from the Microsoft Management Console, not by opening the snapin directly.

  1. Open mmc.exe
  2. When the MMC console opens, click "File" -> "Add/remove snapin"
  3. Select "Group Policy Object Editor" and click the "Add >" button
  4. In the dialog which appears, click "Browse".

  5. Click the "users" tab and select a user.

  6. Click "OK", then "Finish", then "OK" again

You will now have a group policy user object for the selected user. Apply whatever restrictions you want. You may be interested in checking out "Hide these specified drives in My Computer" in User Configuration > Administrative Templates > Windows Components > Windows Explorer.

share|improve this answer
+1 - This is really amazing! I wonder why MS doesn't educate users about such features. Especially since Windows takes utmost care to complicate everything :) Where do you learn such things? Books? – Jarvis Apr 27 '10 at 9:21
@nhinkle What if I wanted to apply the same policies to more the one user on a non-domain Win7? Is there a way to copy them? – AJaM Aug 15 '11 at 12:21
@AJaM I am not aware of a way to copy them. Unfortunately, you'd have to do it for each individual computer. – nhinkle♦ Aug 15 '11 at 16:09
2  
Makes me sad how hidden this is. Took me a while to find a solution and I finally came across your answer. It's great, thank you! – Qosmo Aug 30 '11 at 19:24
+1: This is just what I needed too! I can't believe how hidden this is either. – John H Jul 30 '12 at 16:48
up vote 2 down vote

You would have to makes these group policy changes from an administrator account, not from the limited account.

share|improve this answer
Tried that but it applies to all accounts, how do I make changes to just the limited account? – rzlines Apr 23 '10 at 16:59
Correct me if I'm wrong, but isn't the group policy item to disable USB access in the Machine configuration? If that's the case, it doesn't matter which account you make the change under, it will affect all users of the computer. – dsolimano Apr 23 '10 at 20:06
oh! if that is the case how do I restrict a limited user account. I don't want to limit the admin account, just the user account is all that I want to restrict – rzlines Apr 24 '10 at 13:56
@Rogue, I posted below about the USB devices. I'll think some more about the CD drives and edit when I figure something out. I feel like I'm missing something obvious here. – dsolimano Apr 25 '10 at 1:57
up vote 1 down vote

For restricting access to USB devices, Microsft has a KB article about denying permisison to certain files - http://support.microsoft.com/kb/823732. You might need to leave SYSTEM with access to the files for the other accounts, some trial and error is in order.

EDIT-

There seems to be some fairly affordable third party software that does what you're looking for, but I've not tested it myself. http://www.devicelock.com/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.