启用/允许特定的USB存储设备。 [英] Enable/allow specific USB storage device.

问题描述

大家好，


寻找以下情景的指导或帮助： -



1）机器中的USB通过GPO被阻止，即任何存储设备都不能在机器中使用。

2）鼠标/键盘正在工作，因为它们不是存储设备。

3）想通过注册表或应用程序运行时允许特定的USB存储设备，但只能通过代码而不是GPO。



提前致谢。



我尝试了什么：



试图找出方法...！

解决方案

引用：

在以下场景中寻找指导或帮助： -

简短回答：GPO是出于安全原因设置的，如果你有管理员凭据，可以绕过它。

唯一的办法就是如果应用程序作为管理员帐户运行。



您将使用相同的注册表戳GPO的确如此。



您的小小想法的问题是，如果不允许所有相同类型的设备工作一次，则无法仅允许单个设备你的应用程序可以访问该设备类型。



哦，你无法停止GPO刷新，只会将注册表值恢复到他们应该的状态无论你的应用程序对他们做了什么。

组策略是出于某种原因而设置的。最有可能阻止像你这样攻击公司系统的人。

Hi Guys,

Looking for guidance or help on below scenario:-

1) USB in machines are blocked via GPO ie any storage devices can not be used in machines.
2) Mouse/Keyboard are working as they are not storage devices.
3) Would like to allow specific USB storage device by registry or at application run time but through code only, not from GPO.

Thanks in advance.

What I have tried:

Trying to find out the way...!

解决方案

Quote:

Looking for guidance or help on below scenario:-

short answer: GPO is set for security reasons, you can bypass it if you have admin credentials.

The only way to do that would be if the app was running as an admin account.

You'd be doing the same registry pokes as the GPO does.

The problem with your little idea is that there is no way to allow only a single device without allowing all devices of the same type to work once your app enables access for that device type.

Oh, and you have no way of stopping GPO refresh which will just put the registry values back to what they are supposed to be regardless of what you're app did to them.

Group policy is setup for a reason. Most likely to stop people like you hacking corporate systems.

这篇关于启用/允许特定的USB存储设备。的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！