Want to control the use of unauthorized USB devices in your network? In this guide you will learn how to disable USB ports with three different methods: Using dedicated device control software to disable USB ports, Windows Device Manager, and Group Policies through Active Directory.
With these USB drive blocking methods you’ll be able to disable USB ports in Windows 10, Windows 7, and other Windows operating systems.
AccessPatrol is a device control software solution that protects sensitive data against theft to portable storage devices.
AccessPatrol keeps data secure by…
AccessPatrol’s central console allows you to apply security policies and run reports on your user’s USB activities from the convenience of a web browser.
The security policies are enforced by a software agent that is installed on your user’s computers. This keeps devices restricted and monitored even when the computers are taken off of the network.
Here’s an overview of AccessPatrol’s key features.
Under Device Permissions you can assign unique device control policies for specific groups of computers or users.
AccessPatrol controls a variety of peripherals, including…
Under the allowed list you can specify trusted devices that can be used on your computers.
If you need to temporarily lift device restrictions for devices that aren’t on the allowed list, you can use the access code generator.
This allows you to set a time-limited policy exemption for a specific computer. The access code generator does not require internet access to work, making it the ideal solution for travelling users and other special circumstances.
To further protect sensitive data, AccessPatrol allows you to block file transfers based on file names and extensions. This ensures that even allowed devices can’t transfer sensitive data.
AccessPatrol also includes a variety of USB activity reports to help organizations audit data transfers and peripheral device use.
These reports provide insight into…
AccessPatrol’s reports can be generated on-demand, on a set schedule, or automatically sent to your inbox to alert you of specific events.
Don’t let a preventable data leak ruin your organization. Take back control over portable storage devices with a free trial of AccessPatrol.
Get started today by visiting CurrentWare.com/Download
If you have any questions during your evaluation our technical support team is available to help you over a phone call, live chat, or email.
Thank you!
Your employees have intimate access to corporate data and knowledge of internal systems. Without proper access control measures stealing data is as simple as transferring it to a portable mass storage device such as a USB flash drive.
Flash drives are capable of storing greater than 1TB of data, which is more than sufficient for exfiltrating databases, spreadsheets, design files, and any other intellectual property that needs to be protected.
One use of Data Loss Prevention (DLP) software is blocking the copying of files to a USB flash drive. This prevents employees from using their privileged position to steal sensitive information such as trade secrets and personally identifiable information.
The employee offboarding process presents significant data security risks. Employees have intimate access to corporate data, insider knowledge of the organization’s systems, and a level of trust that can allow them to steal data undetected.
These vulnerabilities need to be addressed as part of any insider threat management program. Click the button below to learn the best practices for protecting data during a termination and gain access to a downloadable IT offboarding checklist.
USB devices can unknowingly infect company computers with ransomware and other malicious software. Disabling USB ports protects endpoints against rogue USB devices by proactively preventing the transmission of malicious files.
Hey everyone, this is Dale here. I am the Digital Marketing Manager for CurrentWare.
In today’s video, I’d like to show off the new USB activity dashboards introduced to AccessPatrol in version 7.0.
These dashboards provide a convenient overview of the peripheral device usage of your entire workforce as well as specific groups or users—all from the convenience of a web browser.
They work in tandem with AccessPatrol’s device control features and USB activity reports to protect sensitive data against the security risks of portable storage devices.
Today’s video is just a sneak peek of what AccessPatrol is capable of; as time goes on you can expect to see further enhancements and data points added to these dashboards.
At this time, AccessPatrol can track activities from the following peripherals:
This device usage data is used to populate various graphs across AccessPatrol’s dashboards. You can further refine how granular this data is by limiting the time frame, selecting only specific groups, and even investigating individual users.
Having these metrics available at a glance makes detecting potential insider threats far more efficient as your organization scales.
Any groups or users that need to be reviewed further can be investigated using the more granular dashboards and AccessPatrol’s device activity reports.
For a more proactive approach to insider threat management you can set up targeted alerts that will notify designated staff members when these high-risk activities occur.
For the most up-to-date information on AccessPatrol’s activity tracking and data loss prevention capabilities, visit our knowledge base at CurrentWare.com/Support or visit the AccessPatrol product page at CurrentWare.com/AccessPatrol
In the overview dashboard you can review the following metrics:
Moving on to the Files Dashboard you will see…
Finally, we have the Devices Dashboard.
In this dashboard, we have…
As you can see, we have specific users that are repeatedly trying to use devices that have not been approved for use by the organization.
While this could just be an accidental oversight on the user’s part, there’s a risk that it’s something much more serious.
For example, what if this is actually a disgruntled employee trying to steal trade secrets or sensitive customer data so they can bring it to a competitor, or worse, sell it to cybercriminals on the dark web.
Between the costs associated with a damaged reputation, fines, loss of competitive advantage, and remediation, a data breach like this could completely ruin a company.
Before we confront this employee or send them for retraining, let’s investigate this incident further so we can make an informed decision.
Clicking on this user, we’ll be taken to a dashboard that focuses exclusively on their activity.
Looking at the Devices graph we can see that they have made multiple attempts to use blocked devices.
Scrolling down, we can see that they’ve been trying to use unauthorized portable storage devices.
Since AccessPatrol is currently blocking any devices that are not explicitly allowed, I know that the only way sensitive data is leaving through a USB drive is if it’s a device that we’ve allowed before. So, let’s take a closer look at how they’ve been using their approved devices.
As you can see here, the types of files that they are transferring are more than capable of containing sensitive data; let’s take a look at the file names for more details.
With the Activity Log we can use the filters, sorting, and column options to isolate our view to the entries we’re the most interested in.
Once we find something that looks off, we have more than enough information to confront this employee and take any necessary corrective actions.
Ready to protect your sensitive data against theft to USB portable storage devices? Block and monitor peripheral device usage today with a free trial of AccessPatrol, CurrentWare’s USB control software.
Simply visit CurrentWare.com/Download to get started instantly, or get in touch with us at CurrentWare.com/Contact to book a demo with one of our team members. See you next time!
Learn how Viking Yachts protected their intellectual property from a departing employee in our case study
Hi this is Dale from the CurrentWare team.
Today I’m going to show you how to get started with implementing your first USB security policies with AccessPatrol.
This video will cover the key features of AccessPatrol, including:
This demo will be using version 7.0.1 so there may be small differences if you are using another version.
Before watching this video you should already have the CurrentWare web console set up, the CurrentWare Clients installed on the computers you would like to manage, and your users or computers placed in their own policy groups.
For more information on installing CurrentWare and setting up your policy groups, please visit the knowledge base at CurrentWare.com/Support.
To start, decide if you will be managing your organization’s USB security policies based on users or computers.
If you select User mode your policies will apply to the users no matter which managed device they log in to; if you select PC mode your policies will apply to a specific computer.
Whichever mode you have selected is the mode that will have its policies active; you cannot operate in PC mode and user mode simultaneously.
If you are using a terminal server to manage your clients you must use AccessPatrol in PC mode.
Alright, let’s get started!
First, I will show you how to block removable media devices using AccessPatrol’s Device Permissions feature.
As of version 7.0.1 the following restrictions are available:
For removable media devices you have three options:
For Bluetooth devices you have:
For everything else you have Full Access and No Access.
In this example I will block USB portable storage devices, CDs/DVDs, and floppy disks on the computers used by our Accounting department.
Once you’ve configured your desired device restriction policies for the selected group, press “Apply” to save your changes. Then, press the “X” button in the top-right corner of the Device Permissions window to close the window.
If you’d like to set unique device restriction policies for each group, simply repeat the same process for each of your groups.
If you’d like to use the same device restriction policies for multiple groups, copy group settings by following these steps:
Be careful when selecting source and destination groups in the Copy Group Settings window; all of the destination group’s previous settings will be overwritten with the selected settings.
Next, I will show you how to allow specific trusted devices while blocking all others using the Allowed List.
This configuration is ideal if you want to prevent unauthorized devices from being used on your computers or if you only want to only allow certain groups to have access to a particular type of device, such as only allowing IT staff to use removable media devices.
To do this:
Now that you have your core USB security policies in place, I’ll show you how to use AccessPatrol’s complementary features.
This section will cover:
The Access Code Generator allows administrators to generate a time-limited single use code for a specific computer or user. These codes can be made on-demand or pre-generated for use within 30 days. The temporary access code does not require internet access to use.
The most common uses for the Access Code Generator are:
If the user has a connection to the CurrentWare Server you will see when their access code is active under the “Devices Blocked” column in the manage window.
To create an access code:
To use the access code, your user must:
Once your user presses the unlock button they will be completely unrestricted by AccessPatrol for the duration that you set when creating the Access Code. During this time you may want to visit that user’s dashboard and monitor them for suspicious activity; I will show you how to do that in another video.
Next, let’s look at the Device Scheduler.
With the Device Scheduler you can modify the device permissions you have set for storage devices based on daily or weekly schedules. Any USB control policies you implement in the Device Scheduler will override the restrictions you placed in the Device Permissions window.
Here are some ways you can use the device scheduler:
Once you’ve added your desired device schedules, return to the main window and set the toggle for “Enable Device Scheduler” to active.
Next, I’ll show you how to use the Block File Transfers feature to prevent file transfers to and from portable storage devices based on keywords in the file name as well as file extensions.
Here’s how to use the Block File Transfers feature:
By selecting “Apply Block File Transfers on Allowed Devices” the Block File Transfers feature can even be used to restrict these data transfers to your trusted devices.
In this next section I will show you how to monitor USB device usage with AccessPatrol’s USB activity reports.
AccessPatrol collects a variety of data points related to peripheral device usage, including:
These data points are then used to populate a variety of reports, alerts, and dashboards that IT security teams can use to investigate potential insider threats such as employees transferring sensitive data to removable storage devices.
Having detailed logs of USB activity is essential for regulated organizations that need to ensure that their USB security policy and data loss prevention methods meet their regulatory compliance requirements.
While the best practice is to block all removable media devices and provide a more secure alternative for data transfers, this is not always practical for some organizations. In those cases, a detailed USB activity log is an essential tool for ensuring that employees and contractors are compliant with the organization’s USB security policies.
Allright, let’s get started
For this example we’ll configure a File Operations History report.
By default the report will include all file operations to removable media devices; you can also use the dropdown menus to selectively include only specific file operations.
These file operations are:
Next, select the computers or users you’d like to include in the report. You can select individual users or computers from a group, the entire group, or your entire workforce.
You can use these sorting options to choose how you want the data to be sorted in the report.
Next, select the reporting period.
Once you have your settings configured you can save it as a report profile. Report profiles are used to automate scheduled reports that will be sent to an email inbox.
They can also be used to configure all of your settings by selecting the report profile rather than manually adjusting the parameters each time. By default your report profiles will be automatically updated to include new users or computers as they’re added; this can be changed in the AccessPatrol settings menu.
Press the run report button to generate the report. This report can then be saved or printed by using the buttons in the top right corner.
If your reports and dashboards are filled with irrelevant information, you can selectively exclude data about specific devices and file names from these reports using the Exclusion List. The Exclusion List is a global setting that will affect the reports and dashboards for all groups.
Here’s how to use the Exclusion List:
Next, I’ll show you how to use the report profile we created in the previous steps to automate the generation and delivery of the reports to designated email inboxes. This Email Reports feature is a convenient way to deliver USB activity reports on a regular basis without having to log in to the web console each time.
If you only want to receive a report when specific events occur I will cover that in the next section when I show you the Email Alerts feature.
Before you begin, you will need to configure your email settings by going to settings > Email settings. You can have the email reports and alerts sent through your organization’s email server as well as a variety of web email services such as Gmail.
How you configure email settings will depend on the email server you use. For more details please visit the CurrentWare knowledge base at CurrentWare.com/Support/
Once your email settings are configured, return to AccessPatrol’s manage section and click the Email Reports button. This main screen will show any currently configured email report schedules.
Next, let’s look at creating email alerts.
Email alerts are similar to email reports except instead of sending reports at a predetermined time AccessPatrol will instead send an alert email when specific parameters are met, such as an employee attempting to insert an unauthorized USB flash drive into a managed computer.
Here at the main screen you will see your currently configured alerts.
To create a new alert:
That’s it for today’s video. If you have any questions you can reach out to the CurrentWare support team at CurrentWare.com/Contact/ or you can get more information from our self-serve knowledge base at CurrentWare.com/Support/
AccessPatrol is a granular and easy-to-use software to disable USB ports in Windows 10, Windows 8, and Windows 7. It allows you to control access to USB devices and other peripherals based on users, computers, workgroups, and domain membership.
This level of control allows you to protect against unauthorized USB devices without blocking the legitimate use of company-controlled peripherals. That way, rather than fully disabling USB ports you can selectively control the USB devices you would like to allow.
It is also a centralized USB blocker software, allowing you to control USB device permissions for thousands of users from a single console. This makes locking USB ports for your entire workforce as easy as a few clicks.
To disable USB ports with AccessPatrol you simply need to install the CurrentWare Console on the Manager’s computer, install the CurrentWare Client on the computers that you would like to disable USB ports on, and return to the CurrentWare Console to assign USB device permissions based on user, endpoint, or workgroup.
Learn how Viking Yachts protected their intellectual property from a departing employee in our case study
In addition to disabling USB ports, the AccessPatrol endpoint security software can block or limit the use of the following peripheral devices. Endpoint device restrictions can be configured based on computer, user, or workgroup.
Device Class | Devices | Access Permissions |
Storage Devices | USB | Full / Read only / No access |
DVD /CD | Full / Read only / No access | |
Floppy | Full / Read only / No access | |
Tape | Full / Read only / No access | |
External Hard drive | Full / Read only / No access | |
Firewire | Full / Read only / No access | |
SD Card | Full / Read only / No access | |
MM Card | Full / Read only / No access | |
Wireless Devices | Bluetooth | Full / No access |
Infrared | Full / No access | |
Wifi | Full / No access | |
Communication Ports | Serial | Full / No access |
Parallel | Full / No access | |
Imaging Devices | Scanners | Full / No access |
Cameras, Webcams & Others | Full / No access | |
Others | Printers | Full / No access |
USB Ethernet Adapter | Full / No access | |
Sound Cards | Full / No access | |
Portable Devices (iPhones, Mobiles) | Full / No access | |
Network Share | Full / No access |
AccessPatrol allows you to prevent specific files from being transferred to external devices based on their filename or file extension.
By default AccessPatrol’s Block File Transfers feature will not apply these restrictions to devices that have been added to the Allow List.
If you would also like to block these file transfers to authorized USB devices you simply need to click the “Apply Block File Transfers on Allowed Devices” checkbox before applying the policy to the clients.
If you would like to disable USB ports for mass storage only (e.g. without blocking keyboards, mice, and other desired USB devices) you can do that with AccessPatrol’s USB drive blocking feature. With this method you can also disable USB for specific user while allowing them for others.
By default, when disabling USB ports with AccessPatrol it will distinguish between USB mass storage devices and other peripherals such as keyboards and mice. It also provides granular control over other portable storage devices such as external hard drives, SD Cards, and mobile phones.
AccessPatrol’s ability to distinguish between mass storage and keyboards makes it the best USB mass storage device blocking software for business.
After following these steps you will be blocking USB mass storage devices while still allowing keyboards and mice to function.
With AccessPatrol’s Allowed List you can disable USB ports while still allowing specific authorized USB devices.
Administrators can use AccessPatrol’s Device Allowed List to establish a list of devices that their end-users can use on company devices, even when USB ports are disabled.
You can choose to allow devices by the following identifiers:
Device whitelisting is configured on a per-folder basis. Devices that are added to the allowed list for a given folder will apply to any computers that are in the specified folder. AccessPatrol’s allowed list supports USBs, External Hard drives, Imaging devices, and portable devices.
Note: Allowing a device by serial number is fully compatible with Windows 10. For Windows 7 or 8, some newer models of USB devices may not support this feature. Instead of allowing by serial number, it will allow all devices from the same vendor and model.
AccessPatrol can grant temporary access to blocked devices using it’s access code generator.
Administrators and authorized managers can use the generator to produce a single-use code that provides users with a set duration where the computer’s USB ports are no longer disabled by AccessPatrol.
The access code is unique to each computer that you generate for and the computers do not need to be connected to the internet to use it. So long as the CurrentWare client is installed on the employee’s computer they can be provided with temporary access to USB devices.
Get started today—Download the FREE template and customize it to fit the needs of your organization.
If you would like to completely disable individual USB ports on a per-computer basis, you can do so with Windows Device Manager.
This method is the most cumbersome to manage when an employee needs legitimate access to authorized USB devices as you will need to manually unlock the ports from the device itself rather than using a central console.
To ensure that the employee does not manually unlock the ports you will need to ensure they do not have access to an administrator account. To re-enable the ports simply perform steps 1-5 and select “Enable device”.
If you would like detailed instructions on how to use a Group Policy Object to block employees from using USB devices you can visit this guide on the CurrentWare blog.
Although applying group policies is a useful way to control the usage of USB storage devices in an organization, there are disadvantages that should not go unnoticed.
GPO vs USB Blocking Software:
Using software to disable USB ports is critical for protecting sensitive data against theft through unauthorized USB devices. If you would like to easily manage USB device permissions in your company you can get started with a free trial of AccessPatrol USB device control software today.
Cookie | Duration | Description |
---|---|---|
__cfruid | session | Cloudflare sets this cookie to identify trusted web traffic. |
cookielawinfo-checkbox-advertisement | 1 year | Set by the GDPR Cookie Consent plugin, this cookie is used to record the user consent for the cookies in the "Advertisement" category . |
cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
JSESSIONID | session | The JSESSIONID cookie is used by New Relic to store a session identifier so that New Relic can monitor session counts for an application. |
LS_CSRF_TOKEN | session | Cloudflare sets this cookie to track users’ activities across multiple websites. It expires once the browser is closed. |
OptanonConsent | 1 year | OneTrust sets this cookie to store details about the site's cookie category and check whether visitors have given or withdrawn consent from the use of each category. |
viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
Cookie | Duration | Description |
---|---|---|
__cf_bm | 30 minutes | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. |
_zcsr_tmp | session | Zoho sets this cookie for the login function on the website. |
Cookie | Duration | Description |
---|---|---|
_calendly_session | 21 days | Calendly, a Meeting Schedulers, sets this cookie to allow the meeting scheduler to function within the website and to add events into the visitor’s calendar. |
_gaexp | 2 months 11 days 7 hours 3 minutes | Google Analytics installs this cookie to determine a user's inclusion in an experiment and the expiry of experiments a user has been included in. |
Cookie | Duration | Description |
---|---|---|
_ga | 2 years | The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors. |
_ga_GY6RPLBZG0 | 2 years | This cookie is installed by Google Analytics. |
_gcl_au | 3 months | Provided by Google Tag Manager to experiment advertisement efficiency of websites using their services. |
_gid | 1 day | Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously. |
CONSENT | 2 years | YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data. |
Cookie | Duration | Description |
---|---|---|
_opt_expid | past | Set by Google Analytics, this cookie is created when running a redirect experiment. It stores the experiment ID, the variant ID and the referrer to the page that is being redirected. |
IDE | 1 year 24 days | Google DoubleClick IDE cookies are used to store information about how the user uses the website to present them with relevant ads and according to the user profile. |
NID | 6 months | NID cookie, set by Google, is used for advertising purposes; to limit the number of times the user sees an ad, to mute unwanted ads, and to measure the effectiveness of ads. |
test_cookie | 15 minutes | The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies. |
VISITOR_INFO1_LIVE | 5 months 27 days | A cookie set by YouTube to measure bandwidth that determines whether the user gets the new or old player interface. |
YSC | session | YSC cookie is set by Youtube and is used to track the views of embedded videos on Youtube pages. |
yt-remote-connected-devices | never | YouTube sets this cookie to store the video preferences of the user using embedded YouTube video. |
yt-remote-device-id | never | YouTube sets this cookie to store the video preferences of the user using embedded YouTube video. |
yt.innertube::nextId | never | This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen. |
yt.innertube::requests | never | This cookie, set by YouTube, registers a unique ID to store data on what videos from YouTube the user has seen. |
Cookie | Duration | Description |
---|---|---|
_dc_gtm_UA-6494714-6 | 1 minute | No description |
_gaexp_rc | past | No description available. |
34f6831605 | session | No description |
383aeadb58 | session | No description available. |
663a60c55d | session | No description available. |
6e4b8efee4 | session | No description available. |
c72887300d | session | No description available. |
cookielawinfo-checkbox-tracking | 1 year | No description |
crmcsr | session | No description available. |
currentware-_zldp | 2 years | No description |
currentware-_zldt | 1 day | No description |
et_pb_ab_view_page_26104 | session | No description |
gaclientid | 1 month | No description |
gclid | 1 month | No description |
handl_ip | 1 month | No description available. |
handl_landing_page | 1 month | No description available. |
handl_original_ref | 1 month | No description available. |
handl_ref | 1 month | No description available. |
handl_ref_domain | 1 month | No description |
handl_url | 1 month | No description available. |
handl_url_base | 1 month | No description |
handlID | 1 month | No description |
HandLtestDomainName | session | No description |
HandLtestDomainNameServer | 1 day | No description |
isiframeenabled | 1 day | No description available. |
m | 2 years | No description available. |
nitroCachedPage | session | No description |
organic_source | 1 month | No description |
organic_source_str | 1 month | No description |
traffic_source | 1 month | No description available. |
uesign | 1 month | No description |
user_agent | 1 month | No description available. |
ZCAMPAIGN_CSRF_TOKEN | session | No description available. |
zld685336000000002056state | 5 minutes | No description |