Active Directory-GPO policy

[cm6043]

Dear friends,

I am a new user of Windows 2000 server. Can anyone tell me how to disable USB devices and CD Rom in GPO policy of Active Directory ?

Thanks
Leung Che Man

 

[aznluvsmc]

After poking through the GPO options I don't think you can do that.

"It's about the journey and not the destination" - The quote of those who never make it

 

[cm6043]

Dear All

Is it every AD Domain Controller have to be DNS server?
And during migration phase (from NT to 2003), will the old WINS server (NT) be able to sync with new DNS server::

Regards

David Fan

 

[tdenitti]

Not every Domain Controller has to be a DNS server but you do have to have at least one. At least it would be wise to.

 

[mrmoneymatters]

Are you sure about "not every domain controller has to be a dns server"?
I thought you have to have dns installed just before you can even install Active Directory.

 

[enbw]

cm6043,

You can bloke access to local drives which will help but it is not a total Safe. You can bloke the cd-rom, it might be wise to bloke autorun as well.

Depending on software applications, usb devices may still be accessible. To be totally safe on this you will need to purchase some software which will integrate into your AD groups. This would allow you to give access to some groups. Not sure of the software name but it can also control other ports. You might be able to disable USB ports on the local machines. Make sure the user can't login locally and they don't have access to computer manager.

Tdenitti, you are right.

Hope this helps