This is a common solution.
Essentially, you disable USB mass storage. What the device is should not be relevant. A smartphone as storage, an external hard drive and a jump drive all pose the same problems, and use the same drivers.
If a USB storage device is not already installed on the computer, assign
the user or the group and the local SYSTEM
account Deny permissions to
the following files:
%SystemRoot%\Inf\Usbstor.pnf
%SystemRoot%\Inf\Usbstor.inf
When you do this, users cannot install a USB storage device on the
computer. To assign a user or group Deny permissions to the
Usbstor.pnf
and Usbstor.inf
files, follow these steps:
- Start Windows Explorer, and then locate the
%SystemRoot%\Inf
folder.
- Right-click the
Usbstor.pnf
file, and then click Properties.
- Click the Security tab.
- In the Group or user names list, add the user or group that you want to set Deny permissions for.
- In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control.
Note: Also add the System account to the Deny list.
- In the Group or user names list, select the
SYSTEM
account.
- In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
- Right-click the
Usbstor.inf
file, and then click Properties.
- Click the Security tab.
- In the Group or user names list, add the user or group that you want to set Deny permissions for.
- In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control.
- In the Group or user names list, select the
SYSTEM
account.
- In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.