The Secure USB configuration is used for both users and computers to block or unblock the use of the USB devices. This configuration is applicable to users irrespective of the computers they use.
Using this configuration, you can block or unblock the following devices:
You can also exclude devices using the Device Instance ID assigned to each device.
Making Secure USB Settings for Users
When you create the Secure USB configuration to block or unblock devices for users, you can set actions to take place once the user logs off. These actions enable you to retain or remove the settings that you make, using the Secure USB configuration, once the user logs off. The actions that you can set include the following:
device status: Use this option to retain the settings you have made, even
after the user has logged off.
For example, if you use this option, the settings that you have made to block or unblock the usage of USB devices will apply to all users who log on.
Disable all devices excluding mouse: Use this option to remove the settings you have made, even after the user has logged off.
Applying Secure USB Settings to Computers and Users
When you apply the Secure USB configuration to both computers and users, the settings made for computers will be applied before the settings made for users. For example, assume that you have made the following settings:
The following actions will take place:
As an administrator, you can create a configuration block or unblock specific USB devices. You can also exclude specific devices, if required.
To create a configuration to secure USB devices for users, follow the steps given below:
You have created configurations to secure USB devices. These configurations will be applied when the user logs in to the computer.
When you block a device you can exclude certain devices from being blocked by using the Device Instance ID assigned to each device. You can exclude devices only when you are creating configurations for users.
Every USB device has a unique ID. This ID is assigned to devices by the system to identify them easily.
Identifying the Device Instance ID of a Device
To identify the Device Instance ID of a device, follow the steps given below:
Figure 1: Device Manager
From the list of devices, expand the list
of devices for which you want the Device Instance ID.
For example, if you want to identify the Device Instance ID of a mobile phone that you have connected to the computer, expand portable devices and follow the next step.
Right-click on the name of a specific device and click Properties (Refer to the figure below)
Figure 2: Properties
Figure 3: Device Instance ID
In computers which have the operating system Windows
Vista (and later versions), the Device Instance ID is called the Device Instance Path. You can copy the
Device Instance Path from the Properties property sheet of the Device
In computers that have older versions of the Windows operating system installed in them, you cannot copy the Device Instance ID directly from the Properties property sheet of the Device Manager.
To copy the Device Instance ID you must open the dcusbaccess log file. This file is located in <Drive>\<Desktopcentral_Agent Folder>\logs\dcusbaccess.log. It contains information about the following:
You can now view and copy the Device Instance ID for a specific device.
You can exclude devices only when you have blocked a device. To exclude devices, follow the steps given below:
You have excluded a device from being blocked.