Disable USB Devices

crosbytr · 05 Jan 2011

I have a stand alone laptop that I have for employees to access SOPs in PDF format. I want to be able to create a 'guest' account that has everything disabled (CD-Rom, networks, USB ports), but still have an administrator account that allows access to everything so I can easily update the procedures. The only thing I want the guest account to do is be able to open an procedure. There should be no editing, deleting, or copying. I don't want to buy any additional software, I am hoping there is a way to have windows do this. Any help would be appreciated.

I've read about methods of changing registry keys and disabling in the device manager, but I'm not sure if that would cross through the user accounts.

Mike Connor · 05 Jan 2011

That is more or less what windows 7 is designed to do. Go into local security policies;

Control Panel --> Administrative Tools --> Local Security Policy;

Have a read through it and the help files. A default guest account already exists as does a "hidden" admin account which has universal control. ( The "default account which most people use is not a "Universal Administrator Account").

You have to activate that admin account;

Click on "enable". Set it up as required with password etc.

Enable the guest account and assign whatever rights you want to give it, using "User Rights Assignment", and that's basically that!

You can delete all other accounts if you want, ( like the one you used to enable the "hidden" admin account). Now all you have to do is assign the rights ( Read only in that case, and no access to anything else ) for the guest account.

Make sure you have a good backup ( image ), and that you don't forget your password, because if you do there is no way to get in to the system.

Regards....Mike Connor

James Colbert · 05 Jan 2011

You don't mention which version of windows you use, but Local Security Policy Editor is only available in in the professional version or higher. Below that (Home Premiuim, etc.), you'll have to use the registry.

Here's a link to a tutorial:

Local Security Policy Editor - Open

James