I'm in a very security concious company which wants access to CD-Rom drives,
floppy disk drives & USB mass storage devices restricted to the majority of
machines. This is easy enough in itself, Ive used an group policy ADM to set
the "start" values for "SYSTEM\CurrentControlSet\Services\USBSTOR",
"SYSTEM\CurrentControlSet\Services\Cdrom",
"SYSTEM\CurrentControlSet\Services\Flpydisk" and
"SYSTEM\CurrentControlSet\Services\Sfloppy" accordingly so as the devices are
disabled via registry.
The issue I have is granting access to those users who are authorised to use
these devices. At present I am applying these settings individually to
different OU's however a multitude of group policies takes a lot longer to
apply than a single, large group policy.
What I would like to do is create a script to temporarily amend these
settings back via regedit which the users can run vioa an ICON & a=only
authorised users can access. The problem with this is that it only works for
USB mass-storage devices. All the others only re-enable on reboot. Does
anyone know of a way around this?
Jordan
