Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to restrict user by not allowing them to use USB flash drives in the computer running xp. I tried to use domain policy as all the machines are connected to the domain but it didn't work. I am using Windows server 2008 R2.

Also i tried to deny access to usb to all the domain user by changing security setting of the usbstor inf and pnf files but it is not working.

Can anybody suggest easy solution to disable usb use in xp machines..

share|improve this question
This question belongs on Server Fault because it is about managing computers in a business setting. Please don't cross-post, as it should be migrated for you shortly. To maintain control of your question after migration, please create an account on Server Fault and associate it with your existing Stack Exchange accounts. – bwDraco Aug 5 '13 at 15:00
@AmritSharma - Just to confirm you have modified the group policy and are logging into a domain account. – Ramhound Aug 5 '13 at 15:05

You can follow the links here to disable it via GPO


In GPEdit.msc (or any other GPO Editor window you're using) click on View > Filtering.

Click to un-select the "Only show policy settings that can be fully managed" check-box. Click Ok.

Now you will be able to see the new settings in the right pane:

An additional step that needs to be performed before the above tip will work has to do with modifying the file access permissions for 2 files. You need to remove the SYSTEM access permissions from the usbstor.sys and usbstor.inf files.

You can do so by right clicking these files > Properties, then going to the Security tab. There you need to remove the line for the SYSTEM account.

Note: Under some circumstances, the SYSTEM should have write access to these files during Service Pack installation. For example, when the SP is installed via GPO or SMS, the installation runs under the SYSTEM Account.

Service Pack needs to replace the files to a new version and without proper write access to the file, installation will fail... Therefore, before each SP deployment we need to allow access to the SYSTEM account for these files.

share|improve this answer

1.Click on Start and then Control Panel.

2.Click on the Performance and Maintenance link.

Note: If you're viewing the Classic View of Control Panel, you won't see this link. Simple double-click on the System icon and proceed to Step 4.

3.In the Performance and Maintenance window, click on the System icon near the bottom of the window.

4.In the System Properties window, click on the Hardware tab.

5.With the Hardware tab selected, click on the Device Manager button.

6.Expand Universal Serial Bus Controllers

7.Disable the ports you don't want anyone to access (don't disable the ports which are connected to components like mouse,keyboard etc)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .