#Usb block port install
Important Note: The install of USB/PS on client machines requires a reboot. If you only want it install on a subset of machines then you can use some Active Directory variable.Įxample: Organizational Unit (Computer) =“Lab Computers” So if you want USB/PS to install on every machine you can leave Validation Logic Rules blank. It's best to have USB/PS install to the machines and use the Settings/Permission Sets to define what rights users get. Use the up and down arrows to select a port, then use the left and right arrows to select either Enabled or Disabled as desired. This is because users can move from one machine to another and if they are used for Validation Logic then any machine that they log into will install USB/PS.
When configuring USB/PS’s Validation Logic, I find that it's best to use only machine names or machine OUs and not user names or user OUs. The Permission Sets will only apply to machines that have USB/PS installed which is defined in the Validation Logic tab. Having a user or group listed in Permission Sets does not automatically mean that they are going to get any USB/PS settings. Validation Logic and Settings/Permission Sets are two separate things. For me I find it easiest to look at USB/PS’s Validation Logic tab as “Where do I want USB/PS installed?”. Before USB/PS can apply any permission sets it needs to be installed on the user’s machine. Next use the USB Exceptions tab to Allow any specific devices that you want users to have access to.įinally Validation Logic.
Then remove “Everyone” from the Users section and add your new USB Lockdown AD group. Your easiest way to configure this is to just create a new Active Directory group (example: “USB Lockdown”) and just add the users you want to lockdown to this AD group. If you want this to apply to everyone but your IT team then it will need to be changed as your IT team is a member of “Everyone”. Next you need to edit the “Users” section of you new Lockdown permission set. If you want to lock down ALL devices but exclude HID devices just use the checkbox for that “Disable all USB devices (Except HID)”. In this example the new USB/PS permission set will be called “Lockdown”. To begin you will create a new permission set in addition to the existing “Default” permission set. The first thing to note is that each USB/PS element starts with a “Default” permission set that is set to Allow every device type and uses the Group “Everyone”. USB/PS is one of the more complex setups in Desktop Authority (DA).
0 kommentar(er)
