Want to control the use of unauthorized USB devices in your network? In this guide I will show you how to disable USB ports with three different methods: Using dedicated software to block USB ports, Windows Device Manager, and Group Policies through Active Directory.Table of Contents
Your employees have intimate access to corporate data and knowledge of internal systems. Without proper access control measures stealing data is as simple as transferring it to a portable mass storage device such as a USB flash drive.
Flash drives are capable of storing greater than 1TB of data, which is more than sufficient for exfiltrating databases, spreadsheets, design files, and any other intellectual property that needs to be protected.
One use of Data Loss Prevention (DLP) software is blocking the copying of files to a USB flash drive. This prevents employees from using their privileged position to steal sensitive information such as trade secrets and personally identifiable information.
The employee offboarding process presents significant data security risks. Employees have intimate access to corporate data, insider knowledge of the organization’s systems, and a level of trust that can allow them to steal data undetected.
These vulnerabilities need to be addressed as part of any insider threat management program. Click here to learn the best practices for protecting data during a termination and gain access to a downloadable IT offboarding checklist.
USB devices can unknowingly infect company computers with ransomware and other malicious software. Disabling USB ports protects endpoints against rogue USB devices by proactively preventing the transmission of malicious files.
AccessPatrol is a granular and easy-to-use software to block USB ports. It allows you to control access to USB devices and other peripherals based on users, computers, workgroups, and domain membership.
This level of control allows you to protect against unauthorized USB devices without blocking the legitimate use of company-controlled peripherals.
It is also a centralized USB blocker software, allowing you to control USB device permissions for thousands of users from a single console.
To block USB devices with AccessPatrol you simply need to install the CurrentWare Console on the Manager’s computer, install the CurrentWare Client on the devices you would like to control, and return to the CurrentWare console to assign device permissions based on user, endpoint, or workgroup.
“With CurrentWare, we’re certain we’re meeting today’s cybersecurity standards whilst maintaining immediate, reliant access to patient records so we can keep delivering a high-quality service to our clients”
IT Service Desk Supervisor
First Choice Health
In addition to preventing the use of USB devices, AccessPatrol can block or limit the use of the following devices. Endpoint device restrictions can be configured based on computer, user, or workgroup.
|Device Class||Devices||Access Permissions|
|Storage Devices||USB||Full / Read only / No access|
|DVD /CD||Full / Read only / No access|
|Floppy||Full / Read only / No access|
|Tape||Full / Read only / No access|
|External Hard drive||Full / Read only / No access|
|Firewire||Full / Read only / No access|
|SD Card||Full / Read only / No access|
|MM Card||Full / Read only / No access|
|Wireless Devices||Bluetooth||Full / No access|
|Infrared||Full / No access|
|Wifi||Full / No access|
|Communication Ports||Serial||Full / No access|
|Parallel||Full / No access|
|Imaging Devices||Scanners||Full / No access|
|Cameras, Webcams & Others||Full / No access|
|Others||Printers||Full / No access|
|USB Ethernet Adapter||Full / No access|
|Sound Cards||Full / No access|
|Portable Devices (iPhones, Mobiles)||Full / No access|
|Network Share||Full / No access|
AccessPatrol allows you to prevent specific files from being transferred to external devices based on their name or extension.
By default AccessPatrol’s Block File Extensions feature will not apply these restrictions to devices that have been added to the Allow List.
If you would also like to block these file transfers to authorized USB devices you simply need to click the “Apply Block File Transfers on Allowed Devices” checkbox before applying the policy to the clients.
If you would like to prevent your users from using USB ports for mass storage without blocking keyboards, mice, and other desired USB devices you can do that with AccessPatrol.
By default AccessPatrol distinguishes between USB storage devices and peripherals such as keyboards and mice. It also provides granular control over other peripheral devices such as external hard drives, SD Cards, Scanners, and Printers.
After following these steps you will be blocking USB mass storage devices while still allowing keyboards and mice to function.
With AccessPatrol’s Allowed List you can block all USB devices except specific company USB devices.
Administrators can use AccessPatrol’s Device Allowed List to establish a whitelist of devices that their end-users can use on company devices.
You can choose to allow devices by the following identifiers:
Device whitelisting is configured on a per-folder basis. Devices that are added to the allowed list will apply to any computers that are in the specified folder. AccessPatrol’s allowed list supports USBs, External Hard drives, Imaging devices, and portable devices.
Note: Allowing a device by serial number is fully compatible with Windows 10. For Windows 7 or 8, some newer models of USB devices may not support this feature. Instead of allowing by serial number, it will allow all devices from the same vendor and model.
AccessPatrol can grant temporary access to blocked devices using it’s access code generator.
Administrators and authorized managers can use the generator to produce a single-use code that provides users with a set duration where the computer’s USB ports are no longer blocked by AccessPatrol.
The access code is unique to each computer that you generate for and the computers do not need to be connected to the internet to use it. So long as the CurrentWare client is installed on the employee’s computer they can be provided with temporary access to USB devices.
If you would like to completely disable individual USB ports on a per-computer basis, you can do so with Windows Device Manager.
This method is the most cumbersome to manage when an employee needs legitimate access to authorized USB devices as you will need to manually re-enable the ports from the device itself rather than using a central console.
To ensure that the employee does not manually re-enable the ports you will need to ensure they do not have access to an administrator account. To re-enable the ports simply perform steps 1-5 and select “Enable device”.
If you would like detailed instructions on how to use a Group Policy Object to block employees from using USB devices you can visit this guide on the CurrentWare blog.
Although applying group policies is a useful way to control the usage of USB storage devices in an organization, there are disadvantages that should not go unnoticed.
GPO vs USB Blocking Software:
USB access control software is critical for protecting sensitive data against theft through unauthorized USB devices. If you would like to easily manage USB device permissions in your company you can get started with a free trial of AccessPatrol today.