Intra-domain group policy disables all client USB storage

Through the hospital this project has just begun to contact the concept of domain, step by step in-depth feel that the domain is broad and profound!

1. The domain controller uses "gpmc.msc" to open the group policy manager (distinguish gpedit.msc)

2. Right-click the domain directory and select "create a GPO in this domain and link here." Enter the name of the group policy to be created in the name, and here you can select "none" to configure your own custom group policy, or select the template policy that has been created by default in the drop-down list, and these template policies are stored under "StarterGPO". If it is convenient, you can directly create a configuration template under "StarterGPO", and then call it under the organization OU. In this way, you don't have to find the configuration policy repeatedly every time)

3. Right-click the newly added domain policy, select "Edit", and select as shown below.

4. The client cmd in the domain runs "gpupdate / force" to force the group policy to be refreshed, and the test is successful.

In addition

There is a difference between "computer configuration" and "user configuration" in the Group Policy Management Editor: the policy set by the computer will take effect on all computer devices in the domain and will affect all user accounts; the policy under the user configuration is only valid for the current user in the domain, but logging in to the domain policy with another user name will not take effect. The configuration of all settings will be saved to the relevant entries in the registry. The computer configuration is saved to the HKEY_LOCAL_ machine subtree of the registry, and the user configuration is saved to HKEY_CURRENT_USER.