Securing USB Devices

The Secure USB configuration is used for both users and computers to block or unblock the use of the USB devices. This configuration is applicable to users irrespective of the computers they use.

Using this configuration, you can block or unblock the following devices:

• Mouse devices
• Disk drives (for example, USB drives and external hard-disk drives)
• CD ROMs
• Portable devices (for example, mobile phones, digital cameras and portable media players)
• Floppy disks
• Bluetooth devices
• Images (for example, USB cameras and scanners)
• Printers
• Modems

You can also exclude devices using the Device Instance ID assigned to each device.

Making Secure USB Settings for Users

When you create the Secure USB configuration to block or unblock devices for users, you can set actions to take place once the user logs off. These actions enable you to retain or remove the settings that you make, using the Secure USB configuration, once the user logs off. The actions that you can set include the following:

• Don't alter device status: Use this option to retain the settings you have made, even after the user has logged off.
  For example, if you use this option, the settings that you have made to block or unblock the usage of USB devices will apply to all users who log on.

• Disable all devices excluding mouse: Use this option to remove the settings you have made, even after the user has logged off.

Applying Secure USB Settings to Computers and Users

When you apply the Secure USB configuration to both computers and users, the settings made for computers will be applied before the settings made for users. For example, assume that you have made the following settings:

• Settings for users
• Administrator: You have unblocked the usage of the disk drive
• Other users (excluding the administrator): You have not deployed any configurations
• Settings for a computer: You have blocked the usage of portable devices and disk drives

The following actions will take place:

• Computer startup: The Secure USB configuration settings made for the computer are applied when the computer is started. This means that no portable devices and disk drives can be used.
• Administrator logon: The Secure USB configuration for the computer is applied. However, it is over written by the settings made for the administrator. This means that the administrator can use disk drives.
• Other users (excluding the administrator) log on: The Secure USB configuration made for the computer is applied.
• Other users (excluding the administrator)log off: The log off-action settings made for users are applied when a user logs off. If the log off-action setting is set to Don't alter device status, then the settings made will apply to the next user who logs on, provided that the user does not have any settings that apply to them.

Top

Creating Configurations to Secure USB Devices

As an administrator, you can create a configuration block or unblock specific USB devices. You can also exclude specific devices, if required.

To create a configuration to secure USB devices for users, follow the steps given below:

1. Click the Configurations tab
2. Click Configuration
3. In the User Configurations section click Secure USB
4. Enter a name and description for the configuration
5. Select the devices to block or unblock
6. Select the required log-off action
7. Define the target
8. Make the required execution settings
9. Click Deploy

You have created configurations to secure USB devices. These configurations will be applied when the user logs in to the computer.

Excluding Devices

When you block a device you can exclude certain devices from being blocked by using the Device Instance ID assigned to each device. You can exclude devices only when you are creating configurations for users.

Every USB device has a unique ID. This ID is assigned to devices by the system to identify them easily.

Identifying the Device Instance ID of a Device

To identify the Device Instance ID of a device, follow the steps given below:

1. Right-click My Computer
2. Click Properties
3. Click the Hardware tab
4. Click Device Manager (Refer to the figure below)

Figure 1: Device Manager

From the list of devices, expand the list of devices for which you want the Device Instance ID.

For example, if you want to identify the Device Instance ID of a mobile phone that you have connected to the computer, expand portable devices and follow the next step.

5. Right-click on the name of a specific device and click Properties (Refer to the figure below)

Figure 2: Properties

1. Click the Details tab
2. In the drop-down box, select Device Instance ID or Device Instance Path (Refer to the figure below)

Figure 3: Device Instance ID

You can now view and copy the Device Instance ID for a specific device.

You can exclude devices only when you have blocked a device. To exclude devices, follow the steps given below:

1. Click the Exclude Devices link against a device
2. Enter the Device Instance ID for the device
3. Click Close

You have excluded a device from being blocked.

Top