Share via

How can I solve it so that a banned USB user is not banned on a specific computer?

johny989 0 Reputation points
2024-04-30T09:40:20.5633333+00:00

Hi,

I have 2 group policies, USB_Disable (all authenticated users are included here) and one USB_Enabled (which contains a group of users). My goal would be that there are machines on which USB must be enabled. How can I solve this?

Thanks

johnny989

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,233 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Karlie Weng 14,721 Reputation points Microsoft Vendor
    2024-05-01T02:05:57.96+00:00

    Hello,

    We may create an exception at the computer level that supersedes the user-level restrictions imposed by the USB_Disable policy:

    1 Create a new GPO specifically designed to enable USB access on computers where it's needed. Within this new GPO, navigate to Computer Configuration > Administrative Templates > System > Removable Storage Access(or similar path depending on your Windows version). Configure the settings to allow USB storage devices, overriding any restrictive settings from user policies.

    2 Link this new GPO to the OU that contains the specific computers on which you want to enable USB access. Alternatively, if the computers are not logically grouped in an OU, use Security Filtering to target the exact computer objects to which this policy should apply.

    Furthermore, we could also consider using Loopback processing of Group Policy : https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy. Group Policy loopback processing mode is a policy setting that allows you to maintain a computer’s configuration regardless of who logs on.

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments