Ne conectam la serverul de Active Directory si deschidem Group Policy Management.

Selectam Organisational Unit-ul in care se afla calculatoarele pentru care dorim sa adaugam restrictia.

Efectuam click dreapta si selectam Create a GPO in this domain and link it here:

Dam un nume sugestiv politicii ( ex. : Restrict USB ) si dam  Ok :

Dam click dreapta pe politica nou creata si selectam Edit :

Deschidem Computer Configuration – > Preferences -> Windows Settings -> Registry. Efectuam click dreapta si selectam New -> Registry Item :

Efectuam urmatoarele:

-In campul Hive selectam HKEY_LOCAL_MACHINE

-In campul Key adaugam HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesUSBSTOR

-Bifam Default in sectiunea Value Name

-In campul Value Type selectam Reg_Dword

-In campul Value Data inseram valoarea 4

-Dam Apply si Ok

Deschidem Computer Configuration -> Policies-> Administrative Templates -> System -> Removable Storage Access si activam urmatoarele ( dublu click si selectam Enabled ) :

-Removable disks: Deny read access

-Removable disks: Deny write access

-All removable storage classes: Deny all classes

-WPD Devices: Deny read access

-WPD Devices: Deny write access