GPO: CD and DVD: Deny write access prevents user from using their USB Pen drive, but other users or ok

My Users have secure pen drives that launch a CDROM partition with a secure logon app that decrypts the main USB mass storage element of the pen drive on successful logon. The problem I have is that users who install the usb pen drive cannot then
initialize the CDROM launcher app to input their password to access the mass storage element of the pen drive making it useless.
However, any other user that has the same type of pen drive who then plugs it in to the endpoint that already has the drivers installed is able to access their own pen drive or the other users pen drive (providing the know the password).
So I've isolated the problem being down to the presence of the GPO setting stated above on the Removable Storage Access Policy, and by not having this policy in place when a user installs the pen drive they have no issues, but I can't find a way to clean
up a user who is already broken even if I remove the GPO from that user, delete their local profile so that they logon as a new user (no roaming or other data) and use a variety of utilities such as USBOblivion to clear out the registry and file system of
the USB device and installation. When the original user logs back on and then installs the usb pen drive again they have the same issue, but no other users do. I have the same issue if I try this with an alternative user or admin as the first user after the
'clean up'. Everyone else can use the pen drive except the user that originally installed it when the GPO was in place.
If I move the user to a new endpoint or rebuild their endpoint then they have no problem being the installer of the usb pen drive and then using it since the GPO was removed, so what I need to know is what is it about the USB install and the GPO that
is tattooing in Windows somewhere and how do I remove it?

Hi,
In my opinion, this is probably not Windows GPO problem. To confirm the suppose, you can follow the path below to check GPO settings if there is any change after the software installed.
Computer Configuration\Administrative Templates\System\Removable Storage Access
User Configuration\Administrative Templates\System\Removable Storage Access
These two policy manage system and current user Removable Storage access.
If there is no change with these policy, it would be better to contact the manufacture of the driver for further assistance.
Roger Lu
TechNet Community Support

Similar Messages

How can I install Windows 8.1 using a USB Pen Drive in Late 2011 Macbook Pro with DVD R/W given.

How can I install Windows 8.1 using a USB Pen Drive in Late 2011 Macbook Pro with DVD R/W given.
I have Boot Camp 5.1.2 (497) and there is no option for installing using USB. I have downloaded an image of Windows 8.1 already.
I can't install using DVD R/W because it's not working.
Please help me.
Thank you.

unlocked by myself
thanks

I have windows 7 and when i start up i tunes i get a message..."The registry settings used by the i Tunes drivers for importing and burning CD's and DVD's are missing. This can happen as a result of installing other CD burning software. Please reinstall i

when i start up i tunes i get the message,"The registry settings used by the i Tunes drivers for importing and burning CD's and DVD's are missing. This can happen as a result of installing other CD burning software. Please reinstall i Tunes." I tried reinstalling and still get the same message. when I ran the i Tunes diagnostics is says that the high and low filters are missing.
when i was having trouble with my optical drive(before Dell sent me a new one) the dell tech support representative had me delete some reg. files to try to fix the problem. I was told this would not affect the new drive when i install it or any of my existing programs. here is what he had me do....
Agent (CLKsmb_RyanJose_224427): "Click on Start
Click on Run
Type in REGEDIT
Click on OK
Click on the plus sign next to HKEY_LOCAL_MACHINE
Click on the plus sign next to SYSTEM
Click on the plus sign next to CurrentControlSet
Click on the plus sign next to Control"
Click on the plus sign next to Class
Click on the plus sign next to {4D36E965-E325-11CE-BFC1-08002BE10318}
On the right pane, click to highlight Upperfilters
Right click on Upperfilters
Click on Delete
Click on OK
On the right pane, click t
o highlight Lowerfilters
Right click on Lowerfilters
Click on Delete
Click on OK
Right click on Silent Install
Click on Delete
Click on OK
Close the Registry Editor
Reboot the computer
how can i get this message box to stop poping up every time i open i tunes? otherwise i tunes works fine. it still rips cd's. I just keep getting this message even after reinstalling i tines.
thanks,
chris

Refer to this article to fix:
iTunes for Windows: "Registry settings" warning when opening iTunes
http://support.apple.com/kb/TS3299

How do i change the language of my keyboard and autocorrect to write a text in spanish using the pages app

how do i change the language of my keyboard and autocorrect to write a text in spanish using the pages app?

Edit > Spelling and Grammar > Show Spelling and Grammar

HT1937 My new 5c is activated with Verizon - I can send receive calls, txts, and data (internet). My problem is that the 5c keeps giving me pop up warnings that the phone is not activated. This is also preventing me from using the vmail

5c is activated and live on Verizon. Call, txts, and data. Issue is that 5c thinks that is is NOT activated - keeping getting pop up warnings. Operationally this prevents me from using v-mail via iPhone app - i need to dial Verizon directly. This phone is new and activated yesterday. Any ideas?

Contact Verizon to troubleshoot the issue with them.

I have a iPad 3 and the iPhone 5 and I can't access yahoo mail from. Either device please help

I have a iPad 3 and the iPhone 5 and I can't access yahoo mail from. Either device please help

Swipe up from bottom of screen.
Control Center
http://support.apple.com/kb/HT5858

How to prevent Oracle from using an index when joining two tables ...

How to prevent Oracle from using an index when joining two tables to get an inline view which is used in an update statement?
O.K. I think I have to explain what I mean:
When joining two tables which have many entries sometimes it es better not to use an index on the column used as join criteria.
I have two tables: table A and table B.
Table A has 4.000.000 entries and table B has 700.000 entries.
I have a join of both tables with a numeric column as join criteria.
There is an index on this column in table A.
So I instead of
where (A.col = B.col)I want to use
where (A.col+0 = B.col)in order to prevent Oracle from using the index.
When I use the join in a select statement it works.
But when I use the join as inline view in an update statement I get the error ORA-01779.
When I remove the "+0" the update statement works. (The column col is unique in table B).
Any ideas why this happens?
Thank you very much in advance for any help.
Regards Hartmut

I think you should post an properly formatted explain plan output using DBMS_XPLAN.DISPLAY including the "Predicate Information" section below the plan to provide more details regarding your query resp. update statement. Please use the \[code\] and \[code\] tags to enhance readability of the output provided:
In SQL*Plus:
SET LINESIZE 130
EXPLAIN PLAN FOR <your statement>;
SELECT * FROM TABLE(DBMS_XPLAN.DISPLAY);Usually if you're using the CBO (cost based optimizer) and have reasonable statistics gathered on the database objects used the optimizer should be able to determine if it is better to use the existing index or not.
Things look different if you don't have statistics, you have outdated/wrong statistics or deliberately still use the RBO (rule based optimizer). In this case you would have to use other means to prevent the index usage, the most obvious would be the already mentioned NO_INDEX or FULL hint.
But I strongly recommend to check in first place why the optimizer apparently seems to choose an inappropriate index access path.
Regards,
Randolf
Oracle related stuff:
http://oracle-randolf.blogspot.com/
SQLTools++ for Oracle:
http://www.sqltools-plusplus.org:7676/
http://sourceforge.net/projects/sqlt-pp/

As a new MacBook user I plug in my USB Flash Drive but don't know how to access its contents. Please help. Thanks.

as a new MacBook user, when inserting my USB Flash Drive, I do not know how to access its contents. Please help. Thanks.

Open a new Finder window, Finder > File > New Finder Window, and it should appear on the left under Devices.
If you don't see it there, or to get it to show up on the Desktop: Finder > Preferences... General tab, check External disks to have it show on the Desktop, Or Sidebar tab, check External disks under DEVICES.

Is there a way to prevent an end-user from changing their own password?

All you guru's out there, I need your help. Is there a way to prevent an end-user from changing their own password? Is there a function or procedure I can create or what?

In this case, you do not want someone (whoever they are DBA etc) to connect as that
particuler user to change the password.Yes, but I wouldn't expect the users to[i] know that password. The connnect would be handled automatically, behind the scenes.
The clear implication of the OP's question and response was that users would not be allowed to change their own passwords. I'm guessing this is in response to a policy that says users mustn't have simple passwords like 123abc or mom. In such a scenario a better approach would be to apply regexp to a user's password to ensure it contains a mix of letters, numbers, punctuation, etc to achieve the desired level of complexity.
So questions, should not be regarded as daft Agreed, but the same is unfortunately not always true of business decisions. As the OP has told us not to ask we cannot know why they want to do this. Personally, I think a user's individual password should always be their responsibility; anything else strikes me as insecure. YMMV.
Cheers, APC

Can't write on my usb pen drive from 2 days?!?

hi, from 2 days i can't write on my usb pen drive (Transcend JetFlash Flash 16gb with FAT32 partition)
if I do a manual mount in a console by root, I can easly a do cp command and copy files over.
if I open dolphin and mount by hal the drive, I can read but not copy files, and if I open a console and do a cp command, I have this error:
cp: cannot create regular file `/media/OZETA/ownage.png': Read-only file system
what the... is going on? i used my pen 4 or 5 days ago
on the contrary, i can mount my sd card (fat32) and my 2 usb disk (fat32 and ntfs) and i can write on them.
help
Last edited by ozeta (2009-05-21 19:10:19)

Have you tried running dosfsck on the device? Of course, be sure that you unmount the usb drive and verify the dev file of the relevant partition.
Something like:
dosfsck /dev/sdb1 <----replace with correct dev file!!
to see what the problem is and then
dosfsck -a /dev/sdb1
Of course, I would strongly encourage you to backup all data on the drive first.
Last edited by madalu (2009-05-22 12:45:26)

Is it possible to connect a USB pen drive to ipad 3 via and adapter?

Is it possible, via an adapter, to connect and access documents on a USB pen drive on an iPad3?

Technically, you can use the camera connection kit to attach certain USB drives to the iPad. That said, the ONLY thing your iPad will see are photos or movies that are named with 8 characters and located in a DCIM folder.
So technically you can attach a USB, however it does not work for documents, only photos or videos.
There are some wireless drives out there, the Seagate GoFlex and the iDrive and some others, but definitely with the Seagate it's often just that you can read from or pull from the drive, you can't put your document back onto the drive to get it off the iPad.

Digital Signatures - how to prevent anyone from using my name

I've created a bunch of forms that have digital signatures enabled. When I've created one either with the PKCS or the Windows Certificate, what's to prevent anyone else from just typing my name, email address and Company Name? Yes, I can create one and save it with a password, but anyone can do that. I'm confused how I can ask our users to use digital signatures on internal documents, then have them email to accounting or HR, yet there's nothing to prevent anyone from using anyone else's name (ie how can I prove that it wasn't me that signed it)?
Is there nothing that's tied to Windows ie I can't use my login ID on our domain unless I use my network password? That's really the ONLY way I can prove I'm me.

Self-signed digital signatures are precisely that - the person creating them is the only one attesting to the contents, so you can make a perfectly-valid self-signed ID for Canta Claus of you want to. The critical thing to remember is that a self-signed ID will only validate if the recipient has your keyfile to compare it to. On your own machine it will show as valid because the key is present, but if you send the PDF to anyone else it will show as invalid unless you have separately transferred them a copy of your keyfile. It's that second file which tells them the ID is really yours, as they can physically check where it came from (e.g. by phoning you up). The recipient would then have to manually add the keyfile to the trusted list in Acrobat or Adobe Reader, and finally your PDF signature will get the green tick.
Self-signed IDs are find for internal company workflows as everyone can share their keyfiles, and the IT department can manage what's going on. If you're using digital IDs in a public setting you should never use self-signed certificates, instead you should purchase an ID from a Certificate Authority - a company whose IDs are tied to the 'root certificates' embedded in Acrobat and Adobe Reader. The CA will require proof of identity before selling you the cert, and so anyone can verify it's genuine without needing to contact you. CAS-issued certs for signing PDF files are not cheap, there are several vendors out there and I won't comment on which may be better.

Your computer systems firewall settings will prevent you from using AirTune

I haven't used my airport express in a while and I just opened itunes with my airport speakers and I got the error message Your computer systems firewall settings will prevent you from using AirTunes. How can I fix this?
Help!!

I have this same exact problem and it is driving me crazy. I am running on OS X 10.4.11 and only started having this problem when I started using the express to join another network. I had always used it as the base but when I joined the wireless network I created with an airport extreme (just bought it a couple of days ago) I can still use the internet fine, and I can print wirelessly, but when I try to use the speakers wirelessly from iTunes it gives me that warning. I'ce tried opening up a whole bunch of ports on my computer but I have no clue how to correct whatever else needs correcting on the extreme.
APPLE! We need your help!

Error message 1202 is preventing me from using itunes can somebody please help ?

Error message 1202 is preventing me from using itunes can somebody please help

Have you tried restarting the iPad? You will more than likely be starting over again with the setup process but you may be able to use the "later" option if you start all over again.
Restart the iPad by holding down on the sleep button until the red slider appears and then slide to shut off. To power up hold the sleep button until the Apple logo appears and let go of the button.

Is it possible to prevent users from using the ''Purge'' option from the ''Recover deleted items'' in Office 365?

Hi,
After speaking with a Microsoft engineer over the phone, I've been told that there is no way to prevent users to go to their OWA and manually Purge specific items from the ''Recover deleted items''. The Microsoft tech told us to place the desired mailboxes
on a litigation-hold and that all data will be recoverable... but only from the time you place the mailbox onto Litigation-Hold and previous items, which doesn't take effect for new-coming emails.
1- From what I understand, any new items coming in the mailbox after the Litigation-Hold is put in place will still be ''purgeable'', right?
2- Is there a way (PowerShell, Security group, etc.) that can prevent a user from using the Purge option?
We are very surprised that there is absolutely no thread that talks about this issue, which in our opinion, is a major legal and security flaw from Office 365. This is a main concern for us to actually go with Office365. For instance, this means that at
any given time, if a user exchanges emails with a competitor, they can manually purge emails sent and receive as soon as it is sent/received, even after Litigation-Hold is in place.
Thank you for your reply and let us know if you have more questions.
Normand Bessette, IT support technician, Newad Media

Thank you for the reply.
Is there still a way to prevent users from using the Purge option, like with a Powershell script to disable Purge?

GPO: CD and DVD: Deny write access prevents user from using their USB Pen drive, but other users or ok

Similar Messages

Maybe you are looking for