DLP

etatsch

Version: Windows Agent Procedure

Description: script to turn off the ability to write to external drives

Instructions:

Compass_Jared

etatsch, this seems like a pretty easy application. You can attempt to apply this setting with the following:

https://www.windowscentral.com/how-disable-access-removable-storage-devices-windows-10

Now, either you can wait for me to write a procedure that checks for the registry key in 32/64bit windows, then applies the new key value OR you can try doing it yourself.

Group Policy is only applicable with Windows pro/enterprise edition. Home is incapable of using Group Policy. I don't know what kind of environment this is being pushed into. I'll update with a procedure at some point.

Compass_Jared

turn_off_usb_storage.zip

This should do what you're looking for. Be sure to add a custom field to Audit → View Individual Data → Machine Summary.

The value in the procedure is "USB External Storage" as a string value.

If you decide to make this value something different you need to update the procedure accordingly.

The procedure applies a registry fix to disable this setting. The procedure will update this value with "disabled" then you can view the custom field within VSA dashboard, Reporting, or the quickview. If you have issues with it. You may need to do some troubleshooting on your end. Again. I don't know your environment. If anything it should give you a good introduction to the Procedure writing.