Windows 7 GPO - Disable All Removable Media then Re-enable, now CD/DVD drive is inaccessible

Question

Ok, this might be better placed in the Windows 7 forum, but we're having some issues with limiting access to removable media via GPO.
We've set up a GPO for Computer Policy, Admin Templates, System, Removable Storage Access, All Removable Storage classes: Deny all access - Enabled
After finding that this was a bit too restrictive we reset it back to Not Configured (and later Disabled to try and force it) but it seems to break our DVD drives on all Win7 x64 machines (the gpo is limited to apply only to these machines).  Instead
of the usual icon in my computer it shows a description of the CD/DVD in the drive and the usual "unknown file type" icon.  if you take the cd out it shows the usual cd rom icon, but still gives "access denied"
There is one workaround, and that is to set the GPO back to not configured and manually remove the CD/DVD device via device manager, restart, and allow windows to re-install the device drivers.
This is 100% repeatable by applying the same local computer policy (All Removable Storage classes: Deny all access - Enabled" and restarting the machine. 
Has anyone else run into this problem before?  And how can we fix it without having to go to every machine to remove the DVD drive from device manager? 
Thanks,
-Nick

Answer 1

Hi,
after looking on many pages for a solution i always found the same workarounds - but for me deleting the device is no option because you aren't allowed to delete devices without administrative rights. Also I can't expect that our users always have to reinstall
the device.
So i analyzed whats going on in the registry when the key "Deny_All" for blocking RemovableStorageAccess is set to 1 - with the running of gpupdate i realized that Windows is writing a registry key to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE\Device\
named "security". The problem is that windows doesn't delete this key after setting the key "Deny_All" back to 0. Only sometimes it will be deleted, for example when you apply the policy for blocking devices and reverse this setting immediatly without a restart
of windows.
I made a little script which I integrated in the user-gpo (as logon script) for granting access to the removable storage devices:
'****SCRIPT START****
' this script searches for all "security"-keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE\ and deletes them
Option Explicit
Const HKEY_LOCAL_MACHINE = &H80000002
Dim oReg : Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
Dim oShell : Set oShell = CreateObject("WScript.Shell")
Dim sPath, aSub, sKey, aSubToo, sKeyToo, dwValue
' Get all keys within sPath
sPath = "SYSTEM\CurrentControlSet\Enum\IDE"
oReg.EnumKey HKEY_LOCAL_MACHINE, sPath, aSub
' Loop through each key
For Each sKey In aSub
    'Get all subkeys within the key 'sKey'
    oReg.EnumKey HKEY_LOCAL_MACHINE, sPath & "\" & sKey, aSubToo
    For Each sKeyToo In aSubToo
        oReg.deleteValue HKEY_LOCAL_MACHINE, sPath & "\" & sKey & "\" & sKeyToo , "Security"
        if Err.Number<>0 then
            Err.Clear
        end if
    Next
Next
'****SCRIPT END****
The policy for giving access to removable storage looks like this now:
- a logon script is executed which searches for all "security"-keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\IDE\ and deletes them
- the setting "All Removable Storage classes: Deny all access" ist set to "Disabled"
I hope this helps...
Regards
Swanson