Allow only certain USB drives in Windows

Question

Information Security

The problem is this: We have an account of flash media in our organization. Computers (running Windows, starting with XP) are not allowed to insert unauthorized devices.

Actually, the question is: how to prohibit the use of them?

The situation is complicated by the fact that the organization does not have a common network, that is, group policies / DeviceLock and others work exactly until the moment when you need to add one more device to all computers (And there are, for a moment, several thousand).
Maybe there are some solutions, for example, a file indicating the serial number, signed by our key on the hidden section of the flash drive, according to which the software understands whether to mount it or not?

Answer 1

Several thousand computers without a single network, but with the need for centralized management - this is called hell.

Answer 2

It can be done purely by means of Windows, but from experience I can say that sometimes it causes random problems in the system.
The registry has a branch HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR, which stores information about installed USB drives, clean the branch, plug in the necessary flash drives, let them install, and then take away the user's rights to this branch, after that Windows simply won't be able to install a new disk.
Also in the system folder there is a file responsible for something similar, you also need to cut the rights to it after installing %\WINDOWS\Inf, usbstor.inf and usbstor.pnf files.

Answer 3

I don't think there is such a thing. Because the idea is pretty pointless. What prevents you from carrying information on an official medium?

Answer 4

Do you have a policy: "everything is allowed except ..."?
By the way, is it forbidden to take pictures of the monitor or print what is needed on the printer (binaries - in mail mime format)?

Answer 5

It is technically possible to write your own service that hangs in Windows and checks the serial numbers of inserted flash drives. If the number is not registered, it disables them.

Answer 6

The option is somewhat simpler, available out of the box, but requires Windows 7 or Windows Server 2008:
1. Ru.Wiki
2. En.Wiki
3. Article

Answer 7

GFI EndPointSecurity
DeviceLock
More functional products, at the same time supported by a "paper":
Secret Net
There is a "Security Server" for centralized management of workstations.
Dallas Lock
Declared "Remote administration of workplaces".