Re: USB, Floppy & CD Drive access through GPO

Well, if the default policy is linked at the domain level, then all computers in the domain are processing it. Is the computer side of the policy showing empty or just the user side? The user side is empty if you have nothing else in that GPO so that would explain that, but if you're saying that the GPO is not processing because the computer side is empty, then that is another problem. Where are those downstream device GPOs linked? To OUs? Do those OUs contain computers or users? Both? Neither?


--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Training Videos, Whitepapers and Utilities for all things Group
Policy-related
Group Policy Management solutions at http://www.sdmsoftware.com




"Komandur Kannan" <kannan@xxxxxxxxxxxxxxx> wrote in message news:8DE3A1DA-BFB3-47E2-8EF9-CEA18E5C4131@xxxxxxxxxxxxxxxx
If that is the case why does it work when I "enable" devices in the default
policy? In other words the 3 policies which has "only" the custom made
policy is failing - have I hit the nail on the head?

Is the policy considered empty if this is the only part in it? Should I be
trying configuring some built-in policy along with it and try?

"Darren Mar-Elia" wrote:

Ok. I see a couple of problems here. First off, just because you disable the
startup of a device driver, does not mean it will become immediately
unavailable after the policy applies. It would typically require a reboot
for that change to be reflected.
2nd problem--this ADM is specific to computer objects, not user objects. So,
if you are trying to control application of the policies via user security
groups, they are going to be ignored, because its the computer objects, not
the user objects that are processing this particular policy.

Darren



--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Training Videos, Whitepapers and Utilities for all things Group
Policy-related
Group Policy Management solutions at http://www.sdmsoftware.com




"Komandur Kannan" <kannan@xxxxxxxxxxxxxxx> wrote in message
news:0B4BE51A-312F-40C3-9928-098E271F7548@xxxxxxxxxxxxxxxx
>I am a subscriber to technet as well as holding OLA agreement with
>Microsoft
> wherein we were promised replies within 1-2 working days.
>
> In regards to my problem, I have set 4 rules.
>
> 1. Default - Applies to all authenticated users, does not allow anyone
> access to any of the devices
> 2. Allow USB Only - Applies the USB part of the policy
> 3. Allow CD Only - Applies the CD part of the policy.
> 4. Allow Floppy Only - Applies the FDD part of the policy.
>
> The above is applied in the same sequence. I have tried the following
> variation - all unsuccessful.
>
> 1. Made the sequence in the reverse order and also "enforced" the > device
> policies.
> 2. Applied the above sequence without any enforcement thinking the > later
> rules will supercede the earlier ones
> 3. Did the reverse - That Allow all access for devices in the default
> policy
> and rules 2-4 was denying access to the devices. In this case, people > who
> are
> allowed to access such devices were "denied" access to the policies > that
> denies access to the device (not an elegant way - I agree).
>
> Users who are allowed to use devices are added in a security group.
>
> I am also thinking of adding the computer instead of user to allow
> devices -
> Though this is not the objective as I want users who are allowed to use
> such
> devices to be able to use it in any computer.
>
> Please advise
>
> Thank you
> Kannan
>
>
> "kj" wrote:
>
>> Are you thinking about the Microsoft Partner "private" Newgroups >> perhaps?
>>
>


.

Relevant Pages

  • Re: Registry tatooing
    ... It can list and clean true policies, ... Speed Group Policy Troubleshooting with the NEW GPHealth Reporter tool at http://www.sdmsoftware.com/products.php ... Well, to his disliking, the settings remained. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Group Policy question
    ... Policies" and Local Security Policy that is a subset of local Group Policy. ... the registry directly unless given direct and cohesive instructions ...
    (microsoft.public.windowsxp.security_admin)
  • RE: security policy not specified option
    ... Resultant Set of Policy does not in any way change the processing of Group ... processing different parts of group policy. ... Machine parses local policy and applies any settings contained in the ... parses computer configuration settings in those policies. ...
    (Focus-Microsoft)
  • Re: Multiple settings configured in one ou group policy
    ... The more policies that you have the more ... create a policy for every setting, as the more policies processed can have ... If you have policy settings that are going to change on a regular basis ... the group policy guide. ...
    (microsoft.public.windows.group_policy)
  • Re: Reset GP back to "out of box" ??
    ... Administrative Template policies (as opposed to ... select Import Policy and choose that setup security.inf file. ... you should remove the settings in the domain ... Group Policy Management solutions at http://www.sdmsoftware.com ...
    (microsoft.public.windows.group_policy)
Quantcast