Restrict drive formatting in domain enviroment

Question

How to restrict users from formating drives? Computers are in a domain environment. May I use GPO or something else?

I'm trying to hide an HDD partition. We use truecrypt and token, and if the drive is not mounted, and user tries to open the encrypted partition, Windows wants to format it. I'm trying to prevent accidental formats.

Solution 1

If the users are limited users, that is not members of the local group Administrators, they will not have sufficient access to format an attached disk. Should you desire to control access for formatting removable media, you can use either domain or local Group Policy:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Devices: Allowed to format and eject removable media

Setting this option to either "Administrators" or "Administrators and Power Users" will prevent limited users from formatting this media as well.

See this Technet article for details.

Solution 2

You mean restrict them from formatting USB drives? Things I've heard of having been done involve gluing ports shut, and/or removing drivers for USB controllers.

As of server 2003 (at least) it looks like there's a way to restrict the drivers in GPO. A quick google came up with http://support.microsoft.com/kb/555324

There may be other versions or slightly altered instructions if you google for "gpo restrict usb." I don't always trust AD because we have had machines that didn't always "take" properly.

Be aware that unless the machine's BIOS is passworded and set to bypass USB and CDROM at boot, a user could still boot from a bootable disc and format things that way (unless you physically blocked the ports) or format the hard disk. Placing this restriction on users just adds another hurdle. It's not a guaranteed stopping measure.

Comments

[joeqwerty]

Can you be more specific regarding what type of drives you're referring to: fixed disks (HDD) or removable (USB).