Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want use windows policy setting to limit access to removable media.

This can be done by setting

[HKEY_USERS\<uid>\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices]
"Deny_All"=dword:00000001

for limiting a specific user

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices]
"Deny_All"=dword:00000001

for all users on the machine.

I'm looking for a method to limit all users, with the exception of one specific local user. However, the limitation appears to be additive - there is no way (that I know of) to define an exception for a specific user.

Is there some kind of alternative?

share|improve this question

1 Answer 1

This is confusing: "the limitation appears to be additive - there is no way (that I know of) to define an exception for a specific user." I am not sure what you mean because you should be able to define exceptions.

Log in as the user, and set his specific HKEY_CURRENT_USER registry entry to allow him to access USB devices by turning off the entry. If he is not an admin, this registry entry will not save, so you will have to either give him admin rights, even if only while you make the change (log out and log back in if you do make him an admin), or log in as an administrator, and find his hive under HKEY_USERS and change it there as an admin.

You will need to set all the others, who currently have profiles not to allow it.

Now, to set it for all future users, navigate to

HKEY_USERS.DEFAULT\Software\Policies\Microsoft

the key structure probably ends here, so add the rest, including the "Deny_All" DWORD value. Any new users logging in, will get that setting.

share|improve this answer
    
disabling removable media access in the machine level (in HKEY_LOCAL MACHINE), and allowing removable media access to a specific user doesn't work. blocking each other user does work, but it's problematic with domain users (there might be many users in the domain) –  Ophir Yoktan Jun 24 '11 at 20:22
    
@Ophir Yoktan I never said do it for HKLM...do it all for current each user with the appropriate permission, then set it up so any future users get the default profile, with the permission denied. –  KCotreau Jun 24 '11 at 22:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.