Manage and control USB equipment in R & D department

Background:

The drawings of the R & D department are often leaked, and the leader says to control USB, but to be able to read, only limit not to write. I wanted to highly recommend Devicelock.

Because of the cost, we have to use the most basic domain policy to implement it.

It's so troublesome to send pictures on 51CTOblog, you'd better write all the words.

Implementation involves two knowledge points:

One: batch move AD objects (users or computers)

Two: group policy settings

One:

Create a new OU named "R & D" in the domain lee.cn

Add a new OU of R & D department, New-ADOrganizationalUnit-name "R & D department"-Path "dc=lee,dc=cn"

2.Powershell commands to migrate all R & D computers (all of which start with YF-XXX) to the newly established OU

Get-ADComputer-filter 'name-like "* YF-*" | Move-ADObject-TargetPath "OU= R & D Department, DC=lee,DC=CN"

Run gpmc.msc to open the Group Policy Editor and select "R & D Department". The OU creates a DisabelUsbWrite GPO and edits the following parameters:

Computer configuration-Policy-Administrative templates-system-removable Storage access

Removable disk: deny write permission: change status to enabled

WPD device: deny write permission: change status to enabled

DVD-CD depends on whether the requirements are set.