1.1.1.2.1.67 Configure 'Devices: Restrict floppy access to locally logged-on user only'

Information

This policy setting determines whether removable floppy media are accessible to both local and remote users simultaneously. If you enable this policy setting, only the interactively logged-on user is allowed to access removable floppy media. If this policy setting is enabled and no one is logged on interactively, the floppy media is accessible over the network. A remote user could potentially access a mounted floppy that contains sensitive information. This risk is small because floppy disk drives are not automatically shared; administrators must deliberately choose to share the drive. However, administrators may wish to deny network users the ability to view data or run applications from removable media on the server.

Solution

Configure the following Group Policy setting in a manner that is consistent with the security and operational requirements of your organization-

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Devices- Restrict floppy access to locally logged-on user only

Impact- Users who connect to the server over the network will not be able to use any floppy disk drives that are installed on the server whenever anyone is logged on to the local console of the server. System tools that require access to floppy disk drives will fail. For example, the Volume Shadow Copy service attempts to access all CD-ROM and floppy disk drives present on the computer when it initializes, and if the service cannot access one of these drives it will fail. This condition will cause the Windows Backup tool to fail if volume shadow copies were specified for the backup job. Any non-Microsoft backup products that use volume shadow copies will also fail.

See Also

https://workbench.cisecurity.org/files/42

Item Details

Category: MEDIA PROTECTION

References: 800-53|MP-2, CCE|CCE-2822-5, CSCv6|8.3

Plugin: Windows

Control ID: 6ebc7ea7023b1616ff41eef26d87541cc7d10aba298d0bf8555cc5052cacd431