Take the 2-minute tour ×

How can I truly disable USB/removable drive support purely with software?

On Windows for example I know I could disable the relevant hardware in device manager, and users would not be able to override this. This would work for the most part.

What about a scenario where there is a local privilege exploit which allows the user to then enable USB ports?

Is there any way to disable USB ports or removable drivers at a lower OS level, or to raise an alert if one is inserted?

share|improve this question
If it's done in software then it can be undone in software. There is no 'software' method that would be immune from exploits. –  RobM May 21 '11 at 23:49
add comment

3 Answers

up vote 0 down vote accepted

There are various pieces of software that will disable USB and/or log enabling/use of USB ports. But like mentioned above if it's a piece of software then in theory it can be disabled. One possible idea is a client/server solution (like how a lot of corporate anti-virus software works) where software enforces policy on the client and the server polls the client to check it's current settings. So there are remote logs that aren't on the compromised client.

share|improve this answer
add comment

You neglected to mention what OS or hardware you were talking about ("Windows for example" is not a specification.

In any case, many BIOSen do allow USB ports or removable media to be disabled below the level of the OS.

You might say, "hey, but I said in software", well, many BIOSen also allow configuration to be done from the OS of the BIOS configuration.

You might say, "hey, but I said local privilege exploit", well, the same BIOSen which allow configuration typically might allow password protection of the BIOS. So you could, at the OS level, disable in the BIOS and set a password/ Then you are protected against being re-enabled without knowing the password or taking the machine apart.

For specific operating system methods of disabling USB ports/mounts (which are typically revertible from the OS level), this is one of many many things which the DoD STIGs mandate and check, so you can get ideas from that.

share|improve this answer
+1 for the BIOS idea. Of course the idea doesn't scale well (or at least is labor intensive), because you have to boot each client into the BIOS to make this change, AFAIK. –  JamesBarnett May 22 '11 at 5:05
@James - That really depends. If the hardware is all standard and from the same manufacturer, you could possibly script the change to the BIOS. For instance, Dell offers a client configuration utility that can be used to make changes to the BIOS on all the machines in your network. –  Jason Berg May 22 '11 at 15:28
@James - Exactly as Jason and I said: "many BIOSen also allow configuration to be done from the OS." –  Seth Robertson May 23 '11 at 0:19
Good call with the Dell client config utility, I'd forgotten about that. –  JamesBarnett May 23 '11 at 8:35
add comment

This is commonly becoming a feature of anti-virus packages. Symantec Endpoint and Trend Micro Worry Free both provide the ability to disable access to USB drives.

share|improve this answer
add comment

Your Answer


