Windows Group Policy Options & Storage

Comment | Print | RSS

• Login to Rate

Group Policy Options (GPO) allow you to control what users can and can't do with respect to removable storage devices. Microsoft recently published a spreadsheet with all of the available GPO settings for Windows Server 2012 and Windows 8. You can download it yourself and browse through all 3,486 entries if you'd like. Here's a link to GPO settings for all versions of Windows.

So what kinds of things can you do with GPO? You could implement a no-removable storage policy by using the Group Policy Editor. I talked in my last post about the security risks of removable storage.

From the Group Policy Editor you should see a list of all removable storage devices from CD and DVD to tape and WPD devices. If you wanted to restrict USB disks, you would need to modify the Removable Disks policy and change the setting for any of the three available policies -- deny execute, read access, or write access. Once you create a policy it must be pushed out to all systems that you wish to have covered and then executed. This can be done in several ways, including using the Windows Server Update Services (WSUS) or by using a login script.

In previous versions of Windows Server, you had to use one or more command line tools to activate a new Group Policy. Windows Server 2012 adds a new feature in the Group Policy Management Console allowing you to select organizational units on which to refresh Group Policy. This only works in an environment with computers joined to an Active Directory domain. Another new feature in Windows Server 2012 is a status reporting tool allowing you to monitor the status of Active Directory and Sysvol replication. AD replication is a key piece of the Group Policy puzzle as it is the mechanism for propagating updates across an entire domain.

If you don't know about the Microsoft Security Compliance Manager (SCM), you should. It's a free tool from the Solution Accelerator team with all kinds of functionality related to security. It includes baseline configurations for all Microsoft operating systems prior to Windows Server 2012 and Windows 8. There's a beta of SCM 3.0 which includes updates for both of these plus Windows Internet Explorer 10. You can find out more here.

If you're in a predominantly Microsoft shop, you have access to a number of system utilities and free tools to manage access to your storage. It might take some time to wade through the help files to figure out which ones you need to tweak, but that will be time well spent.