Enable/disable USB devices on Windows using Active Directory on certain users

Question

I have been asked to disable access to USB devices on Windows machines for information disclosure reasons.

Although this can be done with Active Directory, the problem is that the solution should let us enable access for certain users for limited authorised periods.

How can this be done with Active Directory (if it's possible)?

If not, which software can I use to do it?

Solution

You're talking about a setting that gets applied to computers, not to users. If you don't mind applying it to computers, you could create a security group and place the computers into it which aren't supposed to be "restricted". Modify the permissions of the Group Policy Object in which you're applying these restrictions to include "Deny Apply Group Policy" for the computer group you've created and the settings won't apply to those computers anymore. You can move computers in and out of the group as-necessary, but I'm fairly certain you'd be stuck rebooting the computers to get a change in restriction versus non-restriction to take effect.

Comments

[chmeee]

Rebooting doesn't seem to be a problem here.