ANNEX I:

USB, CD/DVD ROM & REMOVABLE MEDIA DISABLE/ENABLE PROCEDURE

A. Setting Group Permissions for Removable Media Access.

1. Make sure all previously enabled policies related to global User Configuration Policies
are set to Not Defined.
2. Go to Run Command and enter mmc.exe.
3. Enter Ctrl+M.
4. Select Group Policy Object Editor.

5. Select Finish.

6. Expand Local Computer Policy -> User Configuration -> Administrative Templates
-> System -> Removable Storage Access and make sure all items are set to Not
Configured.
7. Enter Ctrl+M and Select Group Policy Object Editor again.
8. On the Select Group Policy Wizard Select Browse and then Users -> Non-
Administrators.

9. Select Finish.
10. Expand Local Computer\Non-Administrators Policy -> User Configuration ->
Administrative Templates -> System -> Removable Storage Access and change
settings as per above screenshot.
11. Enter Ctrl+M and Select Group Policy Object Editor again.
12. On the Select Group Policy Wizard Select Browse and then Users -> Administrators.
13. Select Finish.
14. Expand Local Computer\ Administrators Policy -> User Configuration ->
Administrative Templates -> System -> Removable Storage Access and change
settings as per above screenshot.
15. Please note that steps 11 to 14 are optional and could be used for future audits.

B. Setting Approved USB Devices to be installed.

1. Make sure user logged in is a member of Administrators group.

2. Plug in Customer Approved USB Device (This USB Media to be monitored by Customer
prior to use).
3. After driver installation is complete, go to drive properties.

4. Then Hardware -> Properties then Details Tab then Hardware ID selection.
5. Select first Hardware ID, and then right click and copy (See screenshots below).
6. Save Hardware ID to be used later.
7. Go to Run Command and enter mmc.exe.
8. Enter Ctrl+M.
9. Select Group Policy Object Editor.
10. select Finish.
11. Expand Local Computer Policy -> Computer Configuration -> Administrative
Templates -> System -> Device Installation -> Device Installation Restrictions
and configure as per below.
12. Go to Allow Installation of devices that match any of these device IDs and then
Click Show.

13. Enter Hardware ID collected in step 5 as shown below.

14. Click Ok. You can repeat steps Part B on another storage Media if required.