Restrict USB pen drive access on XP networks

This tip tells you how to disable the USB Pen Drive installation mechanism on a Windows XP network.

The new USB pen drive installation mechanism on XP machines works with two files stored in the Windows/Inf folder:...

usbstor.inf and usbstor.pnf.

To disable this function, you must deny access to the "System" built-in user group for the XP machine.

However, on large networks, changing the permissions for these two files on each individual machine is a hassle. However, you can easily incorporate these permissions into your log-on script as shown below:

cd c:\windows\inf echo|y cacls usbstor.inf /p system:n echo|y cacls usbstor.pnf /p system:n

Now any new USB pen drives connected to the PCs will not be automatically installed. To enable access, you will have to change the n's in the script to f's.

Please let us know how useful you find this tip by rating it below! If you have a useful Windows tip, timesaver or workaround to share, submit it to our tip contest and you could win a prize!

This was first published in September 2006

Dig Deeper on Windows Server and Network Security



Find more PRO+ content and other member only offers, here.



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:









  • VDI assessment guide

    Wait! Don't implement VDI technology until you know your goals and needs. A VDI assessment should consider the benefits of a VDI ...

  • Guide to calculating ROI from VDI

    Calculating ROI from VDI requires a solid VDI cost analysis. Consider ROI calculation models, storage costs and more to determine...

  • Keep the cost of VDI storage under control

    Layering, persona management tools and flash arrays help keep virtual desktop users happy and VDI storage costs down.