You are an Enterprise administrator for contoso.com. The corporate network of the company consists of a single Active Directory domain. All the servers on the network run Windows Server 2008 and all client computers run Windows Vista. The functional level of the domain is Windows Server 2008.
Which of the following options would you choose to ensure that administrators on the network are allowed to install USB drives on their computers and the non-administrative users are prevented from installing USB drives on their computers?
A.
Configure device installation restrictions using a GPO.
B.
Implement Windows BitLocker Drive Encryption.
C.
Use WSRM to configure a per user resource access policy.
D.
Implement the UDDI Services server role.
E.
None of the above
Explanation:
To ensure that administrators on the network are allowed to install USB drives on their computers and the non-administrative users are prevented from installing USB drives on their computers, you need to use a Group Policy object (GPO) to configure device installation restrictions.
You can find the group policy settings called Preventing Installation of Removable Devices and Prevent Installation of Devices Not Described By Other Policy Settings would enable you to achieve the desired goal. These policies can be found in the group policy tree at: Computer ConfigurationAdministrative TemplatesSystemDevice InstallationDevice Installation Restrictions.
Preventing Installation of Removable Devices prevent Installation of Removable Devices setting prevents users from installing removable devices. The Prevent Installation of Devices Not Described By Other Policy Settings prevents the Installation of Devices Not Described by Other Policy Settings group policy setting is kind of a catch all setting. There are a couple of different ways that you can use this policy setting. One thing that you can do is to enable this setting, but not enable any other hardware installation related settings. In doing so, you will effectively prevent anyone from installing any hardware into systems to which the policy applies.
Another thing that you can do with this group policy setting is to use other policy settings to allow specific devices based on device ID or class and then enable this policy setting. In doing so, you will prevent the installation of any device that you have not specifically allowed users to install.
Reference: Windows Longhorn: Using Group Policy to Control Device Management (Part 2)
http://www.windowsnetworking.com/articles_tutorials/Windows-Longhorn-Using-Group-Policy-Control-Device-Management-Part2.html