Remove access to CDRW

[craigs99]

Have been racking my brains to resolve this one so thought I'd throw it open!!
The scenario
We have several users (all using XP, bar 1 whos on w2k so an option for that is welcome aswell) who have cd rewriters.
We cant remove the drives but just want them to act purely as CD-ROMS so effectively disable burning.
I know in GPO and as a reg tweak you can disable XP burning software but equally I want to prevent them from using 3rd party burning software too.
Some are also local admins which prevents me from using the option in GPO to only give admins access to remove and eject media.
Any ideas welcome
Thanks
Craig

 

[bcastner]

Either set an NTFS deny read on permissions to this file or just rename it: C:\WINDOWS\SYSTEM32\WNASPI32.DLL

Also, set the GPO for the native XP burn software.

 

[craigs99]

Thanks, but I'm not sure its going to be that simple!
Ok I understand what the wnaspi32.dll does and it looks like your spot on with that but I cant find a wnaspi32.dll in my system32 directory yet I can happily burn cd's ( before anyone asks I have got hidden files showing ).
Looking again I have nero installed (by default burning software), in the nero directory is a wnaspi32.dll- deleting or renaming this causes nero to stop working but does this mean any 3rd party burning software could therefore house its own copy of this dll? If so its going to be pretty tricky to block
Any ideas?

 

[bcastner]

Several:

1. You publish and distribute a comprehensive Network User Guide, which includes the statement that no software can be installed without the approval of the system administrator; and that failure to strictly adhere to this policy is grounds for immediate termination. Have a sheet where they sign their agreement.

2. In the logon script, unregister the .DLL :
regsrv32 /u /s WNASPI32.dll