landesk硬件限制使用解决方案

WINDOWS硬件限制使用方案LANDesk Software (Beijing)2004-2-71LANDesk程序包生成器使用范例1.1建立安装包1．打开LDMS增强程序包生成器，新建程序。

2．在左边树状菜单中选择“基本安装→Title”，Title中输入“禁用软驱和光驱”，完成后单击“添加”（如下图）3．选择“系统变化→Registry”，在“注册表项→名称”处单击“浏览”找到并输入以下注册表项：HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom，“操作”处选择“query”，在“值→数据类型”中选择“reg_dword”，在“值名称”处输入“Start”，“运算”处选择“replace”，数据值处输入4，单击“添加值”。

上述步骤完成后，单击“注册表项”上方的“添加”按钮添加到源文件编辑窗口。

（如下图）4．按照上述方法添加禁用软驱的注册表项，禁用软驱的项名称为HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Flpydisk将其“Start”值同样改成45．建立程序包并发布，即可禁用客户机光驱和软驱。

1.2LDMS分发脚本范例TITLE: "禁用软驱和光驱"BEGINREGISTRYKEY: query, "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Flpydisk" V ALUE: reg_dword, replace, "Start", "4"ENDREGISTRYBEGINREGISTRYKEY: query, "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom" V ALUE: reg_dword, replace, "Start", "4"ENDREGISTRY2常用硬件设备限制注册表修改参考2.1隐藏驱动器盘符（本方法可用于禁止软驱，光驱及USB存储设备盘符）：1、注册表子项：HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer2、增加二进制项值 NoDrivers 数据默认为00 00 00 00 (HEX)3、禁止驱动器：第一字节A： 00000001（BIN） 01（DEC）01（HEX）B： 00000010（BIN） 02（DEC）02（HEX）C： 00000100（BIN） 04（DEC）04（HEX）D： 00001000（BIN） 08（DEC）08（HEX）E： 00010000（BIN） 16（DEC）10（HEX）F： 00100000（BIN） 32（DEC）20（HEX）G： 01000000（BIN） 64（DEC）40（HEX）H： 10000000（BIN） 128（DEC）80（HEX）第二字节I： 00000001（BIN） 01（DEC）01（HEX）……4、需要隐藏指定驱动器时，将驱动器的数值合计（HEX）即可5、重新启动操作系统2.2禁止USB存储及端口1、If a USB Storage Device Is Not Already Installed on the ComputerIf a USB storage device is not already installed on the computer, assign the user or the group Deny permissions to the following files:%SystemRoot%\Inf\Usbstor.pnf%SystemRoot%\Inf\Usbstor.infWhen you do so, users cannot install a USB storage device on the computer. To assign a user or group Deny permissions to the Usbstor.pnf and Usbstor.inf files, follow these steps:Start Windows Explorer, and then locate the %SystemRoot%\Inf folder.Right-click the Usbstor.pnf file, and then click Properties.Click the Security tab.In the Group or user names list, click the user or group that you want to set Deny permissions for.In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.Right-click the Usbstor.inf file, and then click Properties.Click the Security tab.In the Group or user names list, click the user or group that you want to set Deny permissions for.In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.2、If a USB Storage Device Is Already Installed on the ComputerWARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. If a USB storage device is already installed on the computer, set the Start value in the following registry key to 4:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStorWhen you do so, the USB storage device does not work when the user connects the device to the computer. To set the Start value, follow these steps:Click Start, and then click Run.In the Open box, type regedit, and then click OK.Locate, and then click the following registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStorIn the right pane, double-click Start.In the Value data box, type 4, click Hexadecimal (if it is not already selected), and then click OK.Quit Registry Editor.3、禁止USB端口将“%windir%\system32\drivers\usbhub.sys”改为其他文件名2.3禁用光驱和软驱待修改的注册表键值1. 禁用软驱：HKLM\System\CurrentControlSet\Services\Flpydisk 的“Start”值修改成 0×40。

2. 禁用光驱：HKLM\System\CurrentControlSet\Services\CDRom 的“Start”值修改成 0×40。

修改完成后需要重启计算机。

2.4禁用网络连接待修改的注册表键值HKLM\System\CurrentControlSet\Services\Netman 的“Start”值修改成 0×40。

2.5Internet Exploer控制面板限制The features available within the Internet Explorer control panel (Tools -> Internet Options) can be individually managed and disabled using this tweak.Create a new DWORD value for each restriction from the list below, set the value to equal '1' to enable the restriction or '0' to disable it.∙Accessibility - disables all options under Accessibility∙GeneralTab - removes General tab∙SecurityTab - removes Security tab∙ContentTab - removes Content tab∙ConnectionsTab - removes Connections tab∙ProgramsTab - removes Programs tab∙PrivacyTab - removes Privacy tab∙AdvancedTab - removes Advanced tab∙CertifPers - prevents changing Personal Certificate options∙CertifSite - prevents changing Site Certificate options∙CertifPub - prevents changing Publisher Certificate options∙SecChangeSettings - prevents changing Security Levels for the Internet Zone ∙SecAddSites - prevents adding Sites to any zone∙Privacy Settings - prevents changs to privacy settings∙FormSuggest - disables AutoComplete for forms∙FormSuggest Passwords - prevents Prompt me to save password from being displayed∙Connwiz Admin Lock - disables the Internet Connection Wizard∙Settings - prevents any changes to Temporary Internet Files∙ResetWebSettings - disables the Reset web Setting buttonRestart Internet Explorer for the changes to take effect.Registry SettingsUser Key: [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\ Control Panel]System Key: [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\InternetExplorer\Control Panel]Data Type: REG_DWORD (DWORD Value)Value Data: (0 = disable restriction, 1 = enable restriction)隐藏Internet属性中连接选项卡在HKEY_CURRENT_USER\Software\ Policies \Microsoft\子项下建Internet Explorer子项，下建Control Panel子项，新建ConnectionsTab双字节值，数据值1限制访问拔号连接，新建Connection Settings双字节值，数据值 1，2.6网络连接限制（windows 2000）Create a new DWORD value for each required restriction from the list below. Set the value to "0" to enable the restriction or delete the value to disable it.∙NC_AddRemoveComponents - Restrict add and remove network components∙NC_AdvancedSettings - Restrict changes to Advanced Settings∙NC_AllowAdvancedTCPIPConfig - Restrict changes to advanced TCPIP configuration∙NC_ChangeBindState - Restrict changes to protocol and service bindings ∙NC_DeleteAllUserConnection - Restrict deletion of public RAS connections ∙NC_DeleteConnection - Restrict deletion of RAS connections∙NC_DialupPrefs - Restrict changes to the Dial-up Preferences∙NC_EnableAdminProhibits - Enable Windows 2000 network connections for administrators∙NC_LanChangeProperties - Restrict access to component properties of a LAN connection∙NC_LanConnect - Restrict connecting and disconnecting a LAN connection ∙NC_LanProperties - Restrict access to properties of a LAN connection∙NC_NewConnectionWizard - Disable the Network Connection wizard∙NC_RasAllUserProperties - Restrict access to properties of public RAS connections∙NC_RasChangeProperties - Restrict access to properties of a RAS connection ∙NC_RasConnect - Restrict connecting and disconnecting a RAS connection ∙NC_RasMyProperties - Restrict access to private RAS connection properties ∙NC_RenameAllUserRasConnection - Restrict renaming of public RAS connections ∙NC_RenameConnection - Restrict renaming of connections∙NC_RenameLanConnection - Restrict renaming of LAN connections∙NC_RenameMyRasConnection - Restrict renaming of private RAS connections ∙NC_Statistics - Disable status statistics for an active connectionRestart Windows for the changes to take effect.Registry SettingsUser Key: [HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Network Connections]Data Type: REG_DWORDValue Data: (0 = enable restriction)。