Technical Tip: Isolate domain hosts which have a USB drive access

Description

This article describes how to isolate domain hosts which have a USB drive access if the USB block group policy is not applied or if someone violates the policy.

Scope

FortiNAC-F and Persistent Agent.

 
Solution

To disable USB storage devices via the Windows Registry, change the Start value to 4 in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR.

Changing the Start value to 3 will re-enable the USB access again.

Create a custom scan compliance policy with scan type 'Registry-keys'.

Scenario 1: If the USB block group policy is already applied to the domain host and the USB access is already blocked So this domain host will be compliant with enterprise domain policies.

Scenario 2: If the USB block group policy is not applied to the domain host and the USB access is already allowed, this domain host will be Non-Compliant with enterprise domain policies and FortiNAC will isolate it immediately.