Question
How to restrict mass storage drive and CD-ROM access?
Answer
For Windows 2000, Windows XP and Windows Server 2003 computer, there is no build-in group policy to disable access to mass storage drive and CD-ROM. You can refer to the following Microsoft Knowledge Base articles to block USB storage device installation or usage:
How to disable the use of USB storage devices
http://support.microsoft.com//kb/823732
HOWTO: Use Group Policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers
http://support.microsoft.com/kb/555324
For Vista and later version of Windows client, you can simply configure the following group policies to control the access:
[Computer Configuration\Administrative Templates\System\Removable Storage Access]
CD and DVD: Deny read access
CD and DVD: Deny write access
Removable Disks: Deny read access
Removable Disks: Deny write access
All Removable Storage classes: Deny all access
All Removable Storage classes: allow direct access in remote sessions
Applies to
Windows Server 2000; Windows Server 2003
Windows Vista; Windows 7; Windows Server 2008; Windows Server 2008 R2