Disable USB Storage using a VBS script

Restricting USB storage devices through group policy in Windows Server 2008is a breeze (even on Server 2003). However, it gets a tad challenging when you do it on Windows 2000. Let's play a little scenario:

You need to restrict USB storage access on a shared Windows 2000 PC to prevent users from copying any sensitive information to portable USB storage devices (thumb drives, iPod, MP3 player, mobile phones, etc.). You need to implement a “reversible” solution (this rules out super glue, thanks) and must not cost you an arm and a leg. Here’s a homebrew solution which disables (or enables back) the USB storage function of a PC.

Here's a homebrewn solution (the script uses the resource kit tools Reg.exe and SubinACL.exe):

'variables & constants
Const HKEY_LOCAL_MACHINE = &H80000002
Dim strComputer, strFunction
Dim oShell
Dim oStat

'**** main *****
Set oShell = CreateObject("WScript.Shell")
oStat = False
strComputer = ""
strFunction = ""
'Input ComputerName via an inputbox
strComputer = InputBox("Remote PC's HostName :", _
"USB-Buster Release Candidate (c)", strComputer)
if StrComputer = "" Then
MsgBox ("Null value! Exiting...")
Wscript.Quit
Else
If ping(strComputer) = True Then
'Client is online, do nothing
Else
MsgBox("Error! " & strComputer & " is OFFLINE!")
Wscript.Quit
End If
End if
While strFunction = "" or oStat <> True
strFunction = InputBox("Enable [1] or Disable [2] USB :", _
"USB-Buster Release Candidate (c)", strFunction)
if strFunction = "" Then
MsgBox("Null value! Please enter a valid option ('1' OR '2')")
else
Select case strFunction
case "1"
oStat=True
EnableUSB
case "2"
ostat=True
DisableUSB
case else
MsgBox("Invalid input! Enter a valid option ('1' OR '2')")
oStat=False
end select
end if
Wend
oStat = ""
strComputer = ""
strFunction = ""

'Use Resource Kit Tools (reg.exe and subinacl.exe [latest version]) to
'modify the USBStor start value
'and set deny permissions on the key
'********** Procedures/Subroutines Section *************************
Sub DisableUSB()
oShell.Run "reg add ""\\" & strComputer & _
"\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR""" _
& " /v Start /t REG_DWORD /d 4 /f"
oshell.Run "subinacl /keyreg ""\\" & strComputer & _
"\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR""" & _
" /deny=system /deny=users /deny=administrators"
End Sub

Sub EnableUSB()
oshell.Run "subinacl /keyreg ""\\" & strComputer & _
"\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR""" & _
" /grant=system /grant=users=R /grant=administrators"
oShell.Run "reg add ""\\" & strComputer & _
"\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR""" & _
" /v Start /t REG_DWORD /d 3 /f"
End Sub

'********FUNCTION CALL(S)*********************************
'Ping - to check if computer is connected to the network
Function ping(arg)
With createobject("Wscript.Shell")
'Ping computer
ping = Not CBool(.run("ping " & arg,0,True))
End With
End Function