[gptalk] Re: Script not applicable for local admin

  • From: "Ananth Rajagopal" <ananth.rg@xxxxxxxxx>
  • To: gptalk@xxxxxxxxxxxxx
  • Date: Sun, 11 Mar 2007 18:04:38 +0530

hi Darren,

not all users are local admins only 4 among 100, there belong to research
team, so we had to keep them that way.

I'll try as you told.

thanks for writing.


On 3/10/07, Darren Mar-Elia <darren@xxxxxxxxxx> wrote:

 If your users are local administrators, there is nothing you can do that
they can't get around. By making them local admin the best you can do is
obfuscate things that they may not find. That is not a real solution in my

As for your file copy issue, I would have your batch file test for file
existence before running the copy. Batch supports an "if exists" command
that you can use to easily do this.

*From:* gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] *On
Behalf Of *Ray Lewis
*Sent:* Saturday, March 10, 2007 6:25 AM
*To:* gptalk@xxxxxxxxxxxxx
*Subject:* [gptalk] Re: Script not applicable for local admin


I was faced with this same problem last year.. scripting to set the DWORD
value will indeed disable the device, however, if an alternative stick is to
be used, this doesn't apply….

Using subinacl, to set the USBSTOR registry permissions to DENY for the
SYSTEM "group" should sort out your problem. Download subinacl.exe to a
share and add the following line to your existing script:

"\\*your server*\*your shared folder*\subinacl.exe" /keyreg
\system\currentcontrolset\services\usbstor /deny=system

My scenario was a little different as I wanted standard users to be denied
and for Administrators to be allowed – I controlled this simply via the
login scripts.

Hope this helps…



*From:* gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] *On
Behalf Of *Ananth Rajagopal
*Sent:* 10 March 2007 14:08
*To:* gptalk@xxxxxxxxxxxxx
*Subject:* [gptalk] Script not applicable for local admin

Hi all,

I got 3 questions....

1. we have a script which disables removable usb drive access. but it
doesn't work for local admin logon's . how do i make it applicable for them
too..basically what the script does is it modifies the USBSTOR value from 3
to 4, thus disabling it, but guys who have local admin rights just opens
device manager, removes the usb drives and reinstalls them! thus enabling

2. how can i disable device manager access, even if the user has local
admin rights?

3. we have a scripts which copies some 10mb of data every time users logs
in, even if the files are already in the destination folder it is again
copied, how can i make it a incremental or diferential copy? we do this via
a batch file.

a BIG thanks to all who regularly contribute to this very helpful list!!

best regards
 anth :-)

Other related posts: