Hi, You should add more error handling, this is just a code sample:
#include #include #include #include #include #include #include #include #pragma comment(lib,"gpedit.lib")
int main()
{
HKEY key;
HKEY pol;
DWORD val = 1;
DWORD disp = 0;
GUID ext = REGISTRY_EXTENSION_GUID;
CoInitializeEx(NULL, COINIT\_APARTMENTTHREADED);
CComPtr lgp;
HRESULT hr = CoCreateInstance(CLSID\_GroupPolicyObject, NULL, CLSCTX\_INPROC\_SERVER, IID\_IGroupPolicyObject, (LPVOID\*)&lgp);
if (SUCCEEDED(lgp->OpenLocalMachineGPO(GPO\_OPEN\_LOAD\_REGISTRY)))
{
if (SUCCEEDED(lgp->GetRegistryKey(GPO\_SECTION\_MACHINE, &key)))
{
//All Removable Storage classes: Deny All access
RegCreateKeyExW(key, L"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\RemovableStorageDevices", 0, NULL, REG\_OPTION\_NON\_VOLATILE, KEY\_WRITE | KEY\_QUERY\_VALUE, NULL, &pol, &disp);
RegSetValueEx(pol, L"Deny\_All", 0, REG\_DWORD, (BYTE\*)&val, sizeof(val));
RegCreateKeyExW(key, L"SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\RemovableStorageDevices\\\\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}", 0, NULL, REG\_OPTION\_NON\_VOLATILE, KEY\_WRITE | KEY\_QUERY\_VALUE, NULL, &pol, &disp);
//Removable Disks: Deny write access
RegSetValueEx(pol, L"Deny\_Write", 0, REG\_DWORD, (BYTE\*)&val, sizeof(val));
//Removable Disks: Deny read access
RegSetValueEx(pol, L"Deny\_Read", 0, REG\_DWORD, (BYTE\*)&val, sizeof(val));
//Removable Disks: Deny execute access
RegSetValueEx(pol, L"Deny\_Execute", 0, REG\_DWORD, (BYTE\*)&val, sizeof(val));
RegCloseKey(key);
hr = lgp->Save(TRUE, TRUE, &ext, const\_cast(&CLSID\_GPESnapIn));
\_com\_error err(hr);
wprintf(L"%s", err.ErrorMessage());
}
}
lgp.Release();
CoUninitialize();
return 0;
}
It will set the following policies: - All Removable Storage classes: Deny All access - Removable Disks: Deny execute access - Removable Disks: Deny read access - Removable Disks: Deny write access Best Wishes, -David Delaune [Edit two days later] You can also add an attack surface reduction policy via Windows Defender that requires anything that executes from USB to be signed:
powershell.exe Add-MpPreference -AttackSurfaceReductionRules_Ids b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 -AttackSurfaceReductionRules_Actions Enabled