USB devices control

Block USB devices

To block all flash drives you should edit the current configuration. Open “Admin -> Control panel -> Computer configurations” and choose the configuration. Switch tab to “Devices (USB)” and make changes as: indicated on the screenshot below:

../_images/USB_control_1.png

To block only certain devices, edit “Rules: Access - USB”

../_images/USB_control_2.png

To block devices, enter the device ID in the “Block” field. When you enter the ID, a drop-list of all the devices ever connected to agents appears, you can select and add devices from the list. Save the configuration.

Note

With this configuration only the specified USB devices will be blocked, the rest of devices will work.

To block a class of devices, edit the “Rules: Access - USB-class”:

../_images/USB_control_3.png

To block devices, enter the device class in the “Block” field. When you enter the class name, a drop-list of all the device classes ever connected to agents appears you can select and add device classes from the list. Save the configuration.

Note

Note

With this configuration only the specified classes of USB devices will be locked, the rest device classes will work.

Create a whitelist of USB devices

To create a whitelist of USB devices:

  1. Define the complete list of ID devices that you want to whitelist.

  2. Open “Admin” -> “Computer configuration” menu, select your configuration. Switch to tab “Devices (USB)”.

  3. To create a whitelist, enter the device IDs in the “Allow” field. When you enter the ID, a drop-list of all the devices ever connected to agents appears, you can select and add devices from the list.

../_images/USB_control_4.png

  1. To create a whitelist enter the device IDs in the “Allow” field. When you enter the ID, a drop-list of all the devices ever connected to agents appears, you can select and add devices from the list.

../_images/USB_control_5.png

Add the device classes that should not be locked to this rule.

  1. Save the configuration.

Warning

All devices and device classes that are not whitelisted will be locked!

Define USB Device ID

Defining ID using Staffcop Enterprise

You can define the ID of the USB device for blocking or whitelisting in the web console interface:

  1. Open “Constructor”, select the PC with the connected USB device .

  2. Select the “Device - > Drive type -> Removable” dimension (for removable USB devices).

  3. Select “Device -> HWID” to see ID of all devices connected to the selected PC.

../_images/USB_control_6.png

Defining ID using standart Windows tools

  1. Launch Device Manager.

  2. In the Disk Drivers section find connected flash drive and open its Properties.

  3. On the Details tab select the Parent property.

  4. The ID of the flash drive (HardwareID) will be displayed in the Value field.

../_images/USB_control_6.1.png

Alternative option:

  1. Launch Device manager.

  2. In the USB controllers section find USB Mass Storage device (the name may vary).

  3. Open the Properties window.

  4. On the Details tab select the property Device Instance Path.

  5. The Value of this item is the ID of the USB device (HardwareID).

../_images/USB_control_6.2.png

“Read only” mode for USB-devices

To switch all USB devices to the “Read Only” mode, you need to edit the current configuration in the web console.

Open “Admin -> Control panel -> Agent Configuration” menu, select your configuration. Switch to “Devices (USB)” settings and configure them as on the screenshot below, then save the configuration:

../_images/USB_control_7.png