We have a Computer Config policy with 'All Removable Storage classes: Deny all access' enabled, this applies to the computers OU. This works as expected in that users are unable to use USB storage devices.
We also have a User Config policy with 'All Removable Storage classes: Deny all access' disabled, this applies to the users OU with security filtering on the 'USB-Allow' security group. This doesn't work as expected as members of said security group are unable to use USB storage devices.
I take it that Computer Config 'All Removable Storage classes: Deny all access' win over User Config 'All Removable Storage classes: Deny all access'?
How should we go about denying access to removable storage on ALL systems EXCEPT for certain users?
We want to disable removeable storage against the computer so it applies to both local and ADDS accounts.