Please note that I am not talking about installing additional free software, because I know from experience that by closing a hole with free software you risk opening five more. I suggest using the built-in OS features.
From experience, I know that in order to save money, small companies install such versions of “Home Basic” or “Home Premium” on their staff’s machines (well, they only install this if the company is trying to work legally and does not want a fine for illegal software. And those companies that are not afraid of inspections then install All pirated software and do not suffer))).
And on the “Home Basic” and “Home Premium” versions there are no accessories inherent to their older brothers. And close the ports within our means group policies will not work. Therefore, we need to block access directly to the executive files that initiate the initialization of devices connected to USB ports.
Then we will tell you about services, that is, specialized programs that support other applications or other services. The reasons why you should know services and how to manage them are twofold: first, a service more or less controls access to its ports. Secondly, they most often work as a privileged user - a system or local service.
Ports and protocols and computer access
There are mainly two protocols used to exchange data between computers in a global spider. If the sender does not receive confirmation of receipt of the package, he will resend it. This ensures reliable transmission of data from source to destination, but generates a lot of network traffic as control packets are sent from the corresponding data stream. This may seem like a hopeless solution, but it's just a matter of perspective.
Let's say that there are 3 users on the machine, “Operator”, “Manager” and “Administrator” in the Administrators and Users groups
It is necessary to make sure that the flash drive can only be used by a user under the “Administrator” account.
Turn on the computer, log in as an administrator, open Explorer and write "%SystemRoot%\inf\"(hereinafter in the text copy without quotes).
Assigning ports to protocols
Most network solutions have a rule: one application - one port. Therefore, the port is strictly associated with the protocol used by the listening program. Purpose of protocols application level- interpret packages for usefulness this application. To connect to a program, you need to know what port it is listening on and what protocol it is using.
Port connection
Port numbers and corresponding protocols are unified. This is very easy to use because we don't need to know about the server port configurations when using the service we will be using. Sometimes this applies. In this case, a connection exists between port 80 of the server and the dynamic port of the client. Now we can exchange multiple packets with the server, send and receive kilobytes various information, check the transmission is correct and we will complete the connection.
Next in the search we write “USB”
Will output approximately 18 elements. (depends on what system is installed, OS version, installed additional drivers for USB)
We essentially only need 8 files.
usb.inf
usbstor.inf
usbport.inf
winusb.inf
usb.PNF
usbstor.PNF
usbport.PNF
winusb.PNF
Then we need to block access to these files to other users. Right click on the file "usbstor.inf" -> "properties"
Go to the tab "safety", and press the button "change"
Then we select the users we need to disable. For us these are “Operator”, “Manager” and “System”. If we need to disable all accounts that belong to the “Users” group (these are “Operator” and “Manager”), then we simply ban the group. If only a specific one, let’s say “Operator”, then select this particular account.
Attention, the “System” account also needs to be blocked from using the file.
Then we set a ban on use, switch to another user and also set bans. When required users will be disabled (for me it is only “system” and “users”)
click the “Ok” button
Here we are not sure whether the server will receive the packet due to the lack of transmission control mechanisms in this protocol. If the server we are sending data to is not listening on the port we are trying to connect to, our packets are rejected. You cannot limit the number of open ports without knowing which ports are active and what programs they are using - we can disable external access and thereby prevent communication with Internet resources or local network. While there is no single tool that will give you all the information you need, we will use several helpers.
There will be a warning that this will lead to the fact that access to the file will be unavailable and all that (if you want, you can read it), click the “Ok” button again.
Again we read the message about whether we really want to do this (you can read it if you wish), and press the “Ok” button again.
And we repeat this procedure for the next 7 files.
usb.inf
usbport.inf
winusb.inf
usb.PNF
usbstor.PNF
usbport.PNF
winusb.PNF
Restrict access to ports
Do you already know which page we are viewing and in which browser? It is now easy to determine which programs are listening on these ports. This way you can get information about every active or listening port on your computer. Our main goal is to limit the number of ports that are accessible from the outside. We can accomplish this in three ways.
This easy-to-use tool allows us to block all incoming traffic, except for calls initiated from our computer. Internet connection firewall. . On the General tab, select Internet Protocol and click the Properties button.
If this is only an installed OS, then everything is in order and, in theory, access to the flash drive will not be available to selected users. However, if flash drives were already connected to this system by those users who needed to disable access to flash drives, then you will need to change the key in the registry.
Click start -> write regedit -> open the registry
Open the folder “USBSTOR”
and change the value of the “Start” parameter to 4
In fact, this service is useless. If you block them, you won't be able to use the Internet on your own. It can control incoming and outgoing traffic and, depending on the filtering model, a particular connection can be blocked, forwarded, authenticated, encrypted, or authenticated and encrypted at the same time.
Most automatically start with the system. By closing unnecessary services, we can increase not only security, but also computer performance. The service management console is available on the control panel. Select Administrative Tools and click the Services icon.
Tags: disable, USB ports, flash drive
USB ports can be disabled without using third party programs. Windows tools You can turn off all USB ports at once, or those that need to be turned off at the moment.
The theft of confidential information from users' computers is currently extremely important. To prevent data leakage, you may need to disable USB ports. Very often we have to connect various external storage devices to the PC, in particular via USB ports. These external devices may contain malicious code, which is actually the reason for the “leaking” of confidential data into the hands of “malware”. Today we will tell you how you can teach your computer to quickly disconnect USB ports without resorting to installing and using third-party programs.
The services we start will be known by the Status column. The Startup Type column specifies how the services will be started. Most services can be turned on and off freely. Once in the wild, you rush to close each service in turn, remember - turning off a service necessary for the system will not be able to start it. Services that can be safely disabled include.
Prevent users from connecting USB storage devices using a Microsoft app
Other services should be left at their default settings. It is usually recommended to switch the service manually first, work on your computer for a few days and disable the service until the system becomes abnormal.
To realize our plans, we will need to make some changes to Windows registry. To do this, first we need to open it, for this in the search engine Windows line(in Windows XP-7 the search bar is located in the “Start” menu, in Windows 8 on the panel, as shown in the figure below) you must enter regedit command, press the “Enter” key and select the registry editor regedit.exe from the search results.
If using the first solution does not solve the problem, move on to the next solution. Solution 1: Turn on your console after 5-10 seconds. . Sometimes it is necessary to press this button several times. When stopped, access to the disk will not be possible. When you select the Disable button, the Open Disk option will be disabled.
Hardware damage to ports
By default, two are created Accounts, which cannot be deleted and for which you cannot change the username. In addition, you can create additional elements. If you see the box below, enter your username and password. The maximum supported image size is 22 megapixels.
In the registry editor window that opens on your screen, to start disabling USB ports, go to the “UsbStor” registry key, opening the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services sections in sequence. Find the “Start” parameter in the final section, click on it with the left mouse button and context menu select “Change” and change its value from “3” to “4”, where “3” is the default value of the parameter.
Using serial number connected device operating system will create a unique identification key for each device. The program does not need to be installed and used on any computer on a memory card. If you only want to allow certain devices to work on your own computer, you will need to use commercial solutions. For example, software, which we happen to browse on the Internet and which was created by a Romanian company, gives the computer administrator the ability to allow the use of certain devices.
After changes have been made to the registry, a flash drive connected to the computer via a USB port will still be detected by the system, but will not automatically connect to it. In other words, it will be impossible to write data from the flash drive or run any programs from it. If you need to return the USB port settings to their original ones, all you need to do is change the value of the “Start” parameter to the previous one, that is, “3”. In this case, you do not need to restart your computer for the changes you made to take effect.
Disable certain USB ports
There are times when it is not possible to disable all USB ports on the system at once and you only need to disable some of the USB ports. In this case, you can use another method.
Launch “Device Manager” on your computer, then find it and go to the “USB Controllers” line. By the way, to open “Device Manager” just press the key combination “Win” + “Pause” and in the window that opens, click on the corresponding link on the left side.
Now in the newly opened “Properties” window USB ports” Go to the “Drivers” tab and click on the “Disable” button in it. All is ready!
We hope that you have found the answer to your question - “how to disable USB ports” and now, depending on the situation, you will be able to disable them all at once, or only those that you consider necessary.
