How to protect data in a Windows domain?

Question

Encryption

Hello. There is a Windows domain in which you want to protect data on workstations from leakage outside the domain.
Interested in protection against removal on external drives (USB, CD). CD-ROM can in principle be banned by politicians. I see the following scenario: the user inserts an allowed flash drive into the USB (or card reader) of the domain computer, it checks whether it is allowed to use the device with the current ID, and if everything is fine, he gets access to the drive and can upload his files to it (can be implemented via GPO). But it is necessary to provide that the user cannot take this information out of the domain on an authorized flash drive. Only encryption of information on this device comes to mind. Moreover, the decryption key must also be distributed to all domain computers and the user will not notice anything if he inserts it into the domain computer.
Workstations predominantly Windows 7, 8.1 and servers 2012R2

Answer 1

Only encryption of information on this device comes to mind. Moreover, the decryption key must also be distributed to all domain computers and the user will not notice anything if he inserts it into the domain computer.
Workstations predominantly Windows 7, 8.1 and servers 2012R2

Well, if 7 and 8 are everywhere, then look towards BitLocker. He knows how to encrypt flash drives. If you have XP (I hope not anymore),
then look not at TrueCrypt. Similarly - encrypts disks / flash drives.
There is also SecretNet, it seems that he can do something like that. But, dog, not cheap. But with FSTEC certificate

Answer 2

Write nonsense, make balloons and ban flash drives, you can distribute a file within the network using a balloon, flash drives are not needed.

Answer 3

Prevent users from installing new devices (in general), having previously configured all available ones, remove burners from users' PCs. Disable any COM ports at all - you can also connect a modem via RS-232 and pull quite a lot without having admin rights and without installing any drivers.

Answer 4

InfoWatch, among other things, can do this.

Answer 5

yes, they took it out a long time ago and sold it,

you need to transmit large amounts of information, and the channel is not so wide

expand