脚本干活：BAT批处理禁用USB存储设备

以前写的一个批处理，主要用于禁用USB存储设备（包括U盘，移动硬盘等）
比较适用于企业网络环境，即用户端没有管理员权限的情况下。
测试环境为Windows XP SP3，NTFS文件系统。
注意是存储设备。像USB鼠标和USB键盘是不会给禁用的。

注：该批处理是我在大学毕业后第一家公司时所写，大概在2008年左右。 当时参考了微软官方的技术文档，写成批处理是方便管理员快速执行。
配合psexec的话可以实现远程执行多台电脑。也可配合Windows域进行部署。 现在网上很多转载的我的这个批处理，有的是去掉了前面的说明，其它都没换，比如usb_temp.reg名字也没换，删除的用户组的顺序也没换。不注明出处也罢，说他自己原创我就无语了。本来就没什么技术含量的东西。

原发表时间已无法确定。
目前能看到的最早的转载时间为2008-10-11 23:43:00
为方便记录历程,特将本文的发表时间设置为那个时间.

@echo ************************************************
@echo . CopyRight
@echo . http://linc.hu
@echo ************************************************
@echo off
cacls %SystemRoot%\inf\usbstor.inf /e /c /d system
cacls %SystemRoot%\inf\usbstor.inf /e /c /d "power users"
cacls %SystemRoot%\inf\usbstor.inf /e /c /d users
cacls %SystemRoot%\inf\usbstor.inf /r "everyone" /e
cacls %SystemRoot%\inf\usbstor.PNF /e /c /d system
cacls %SystemRoot%\inf\usbstor.PNF /e /c /d "power users"
cacls %SystemRoot%\inf\usbstor.PNF /e /c /d users
cacls %SystemRoot%\inf\usbstor.PNF /r "everyone" /e
cls
@echo Windows Registry Editor Version 5.00>>%temp%\usb_temp.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR]>>%temp%\usb_temp.reg
@echo "Type"=dword:00000001>>%temp%\usb_temp.reg
@echo "Start"=dword:00000004>>%temp%\usb_temp.reg
@echo "ErrorControl"=dword:00000001>>%temp%\usb_temp.reg
@echo "ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\>>%temp%\usb_temp.reg
@echo  52,00,49,00,56,00,45,00,52,00,53,00,5c,00,55,00,53,00,42,00,53,00,54,00,4f,\>>%temp%\usb_temp.reg
@echo   00,52,00,2e,00,53,00,59,00,53,00,00,00>>%temp%\usb_temp.reg
@echo "DisplayName"="USB Mass Storage Driver">>%temp%\usb_temp.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Security]>>%temp%\usb_temp.reg
@echo "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\>>%temp%\usb_temp.reg
@echo   00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\>>%temp%\usb_temp.reg
@echo   00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\>>%temp%\usb_temp.reg 
@echo   05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\>>%temp%\usb_temp.reg
@echo   20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\>>%temp%\usb_temp.reg
@echo   00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\>>%temp%\usb_temp.reg
@echo   00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00>>%temp%\usb_temp.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Enum]>>%temp%\usb_temp.reg
@echo "Count"=dword:00000000>>%temp%\usb_temp.reg
@echo "NextInstance"=dword:00000000>>%temp%\usb_temp.reg
cls
regedit /s %temp%\usb_temp.reg
del %temp%\usb_temp.reg
@echo off
cls

2018.12.11 更新:这是一个神奇的网络,至今还有人搜索到此文.为方便起见,附上解禁的脚本:

cacls %SystemRoot%\inf\usbstor.inf /e /c /g system:c
cacls %SystemRoot%\inf\usbstor.inf /e /c /g "power users":c
cacls %SystemRoot%\inf\usbstor.inf /e /c /g users:c
cacls %SystemRoot%\inf\usbstor.inf /r "everyone" /e
cacls %SystemRoot%\inf\usbstor.PNF /e /c /g system:c
cacls %SystemRoot%\inf\usbstor.PNF /e /c /g "power users":c
cacls %SystemRoot%\inf\usbstor.PNF /e /c /g users:c
cacls %SystemRoot%\inf\usbstor.PNF /r "everyone" /e
 
echo Windows Registry Editor Version 5.00>>%temp%\usb_temp.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR]>>%temp%\usb_temp.reg
@echo "Type"=dword:00000001>>%temp%\usb_temp.reg
@echo "Start"=dword:00000003>>%temp%\usb_temp.reg
@echo "ErrorControl"=dword:00000001>>%temp%\usb_temp.reg
@echo "ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\>>%temp%\usb_temp.reg
@echo 52,00,49,00,56,00,45,00,52,00,53,00,5c,00,55,00,53,00,42,00,53,00,54,00,4f,\>>%temp%\usb_temp.reg
@echo 00,52,00,2e,00,53,00,59,00,53,00,00,00>>%temp%\usb_temp.reg
@echo "DisplayName"="USB Mass Storage Driver">>%temp%\usb_temp.reg
@echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Security]>>%temp%\usb_temp.reg
@echo "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\>>%temp%\usb_temp.reg
@echo 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\>>%temp%\usb_temp.reg
@echo 00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\>>%temp%\usb_temp.reg
@echo 05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\>>%temp%\usb_temp.reg
@echo 20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\>>%temp%\usb_temp.reg
@echo 00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\>>%temp%\usb_temp.reg
@echo 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00>>%temp%\usb_temp.reg
 
regedit /s %temp%\usb_temp.reg
del %temp%\usb_temp.reg

转载请注明：Linc Hu » 脚本干活：BAT批处理禁用USB存储设备