Working with Device Security Policies

The Group Policy editor offers several device-related policies. To see them, open the Group Policy editor and select Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options. Here are the policies in the Devices category:

• Allow Undock Without Having To Log On When this policy is enabled, users can undock a notebook computer without having to log on to Windows XP (that is, they can undock the computer by pressing the docking station’s eject button). If you want to restrict who can do this, disable this policy.

  Insider Secret

  To control who can undock the computer, select Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignment. Use the Remove Computer From Docking Station policy to assign the users or groups who have this right.

• Allowed To Format And Eject Removable Media Use this policy to determine the groups that are allowed to format floppy disks and eject CDs and other removable media.

• Prevent Users From Installing Printer Drivers Enable this policy to prevent users from installing a network printer. Note that this doesn’t affect the installation of a local printer.

• Restrict CD-ROM Access To Locally Logged-On User Only Enable this policy to prevent network users from operating the computer’s CD-ROM or DVD drive at the same time as a local user. If no local user is accessing the drive, the network user can access it.

• Restrict Floppy Access To Locally Logged-On User Only Enable this policy to prevent network users from operating the computer’s floppy drive at the same time as a local user. If no local user is accessing the drive, the network user can access it.

• Unsigned Driver Installation Behavior This policy determines the action Windows XP takes if it comes across an unsigned device driver. There are three choices: Silently Succeed; Warn But Allow Installation; and Do Not Allow Installation.