 |
 |
 |
Windows Longhorn: Using Group Policy to Control Device Management (Part 1)
Thursday, August 10th, 2006
One particularly challenging aspect of Windows security has always been controlling the user’s 
access to the hardware on their workstation. Years ago, some of the more security conscious companies were removing CD-ROM and floppy drives from workstations. Today though, USB ports are an even more serious threat. Most electronics stores sell USB adapters for hard drives that allow the drives to be used externally. What this means is that it is easy for any user to plug in an external hard drive and copy all of the data that they have access to. I have known of companies to fill workstation USB ports with epoxy in an effort to prevent such intrusions.
If you don’t like the idea of permanently damaging workstation hardware, then there are a variety of third party products that are designed to help to restrict the user’s access to a workstation’s hardware. For example, GFI makes a product called GFI End Point Security (http://www.gfi.com/endpointsecurity/) that is designed to regulate which types of USB devices users are allowed to use. In Longhorn Server though, you will be able to regulate device management via group policy.
The Available Group Policy Settings
Longhorn Server offers several different group policy settings that can be configured in an effort to control device usage on workstations. If you open the Group Policy Editor, you can find the device installation related settings at Computer Configuration | Administrative Templates | System | Device Installation | Device Installation Restrictions. Figure A shows the group policy settings that are available. Before I talk about the individual group policy settings though, I should mention that these settings are only effective on computers running Windows Vista or Longhorn Server. They can not be used to lock down devices on computers running Windows XP.Windows Longhorn: Using Group Policy to Control Device Management (Part 1)
Popular Posts
Please read our Disclaimer
