Tutorial: How to enable USB drives

Domain administrators disable USB drives in the company. While there are valid reasons to do so sometimes this is a genuine problem to many. This step by step guide tells you how to enable USB drives.

This procedure is for Windows/XP only. You need local administrator privileges on your PC.

Note: If you follow the procedure in exact reverse order, you can disable USB drives on your PC.

Step 1: Enable access to USB driver files (.inf/.pnf)

1. From the 'Start' menu, click on 'Run' (Start --> Run). Enter 'c:\windows\inf'. Click on 'OK'.
   
   Attachment 3594
2. The File Explorer will open 'C:\Windows\inf' folder. Do as said in the picture below.
   
   Attachment 3595
3. In the properties window, do as stated in the picture below.
   
   Attachment 3596
4. Add 'Everyone' to the list.
   
   Attachment 3597
   Attachment 3598

Step 2: Enable USB in registry
(Continues in next post ...)

Step 1: Enable access to USB driver files (.inf/.pnf)
(... from previous post)

Step 2: Enable USB in registry
Now that you have enabled the access to the USB drivers, the next step is to enable the USB access in the windows registry.

1. From the windows 'Start' menu, start the 'regedit' program
   (Start --> Run --> regedit --> <ENTER>)
2. From the registry editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\SERVICES as shown in the picture below.
   
   Attachment 3599
3. Open the key 'USBSTOR'
   
   Attachment 3600
4. Check the value of the 'Start' key. It should be '3'. If the value is not '3', double click it to edit its value.
   
   Attachment 3601
5. Set the value as '3' and click 'OK'.
   
   Attachment 3602

You are all set now.

Please rate this article. Repo's not expected.

Good info but normally in domain environment users may may not have local administrator privileges.

Yes and No.

I work in a corporate. But I do have admin rights on my laptop. Every day USB gets disabled on my laptop.

In gpedit.msc also some settings to block removable data storage devices. not remebering.

Good one

Rated

Ek dum 5 ***** rated thread..kixxi...

Good info kix. .. keep them coming

As stated above, there are two steps. No one asked the importance or utility of step 1.

Step 2 is enough to enable (or disable) USB. So why do domain admins also do?

They disable the access to the drivers. Usually all USB drives are PnP (plug and play). When a USB stick is inserted into the USB port, Windows checks for the associated and the correct driver file for the device. It will go to USBSTOR.inf and USBSTOR.pnf to discover the device driver.

Now if the access to the two files is disabled for the logged in user, then the driver for the USB device cannot be loaded, let alone enabled or disabled. That is why it is important to grant the access to those files.

Scenarios
a) You had two USB drives - one made by Transcend and other by Kingston.
b) Your PC is domain controlled in your office
c) The domain admin continuously run remote scripts on your machine thereby disabling .inf/.pnf access and disable USB in registry.
d) You have admin rights on PC

Scene 1: You insert the Transcend drive the VERY FIRST time
a) You do not follow step 1 and step 2. Result: FAILURE. Your drive will NOT be usable.
b) You do not follow one or both of the steps. Result: FAILURE. Your drive will NOT be usable.
c) You follow step 1 and step 2. Result: SUCCESS. Your drive will be usable.

Scene 2: You insert the Transcend drive next time
a) You do not follow step 1 and step 2. Result: FAILURE. Your drive will NOT be usable.
b) You follow step 1 but not step 2. Result: FAILURE. Your drive will not be usable.
c) You do not follow step 1 but follow step 2. Result: SUCCESS. Your drive will be usable. This is because the actual driver file (.sys) is already loaded in the \windows\system32 folder.
d) You follow step 1 and step 2. Result: SUCCESS. Your drive will be usable.

Scene 3: You insert the Kingston drive the first time
a) You do not follow step 1 and step 2. Result: FAILURE. Your drive will NOT be usable.
b) You follow step 1 but not step 2. Result: FAILURE. Your drive will not be usable. But the driver file will be loaded in the \windows\system32 folder.
c) You do not follow step 1 but follow step 2. Result: MIXED. If the actual driver file (.sys) is already loaded in the \windows\system32 folder then your drive will work, else not.
d) You follow step 1 and step 2. Result: SUCCESS. Your drive will be usable.

the reason for mixed failure in case of some pen drives is that when you first use an USB on any computer then just for that first time windows initiate a new hardware found wizard to load particular driver file for that drive.once this process is over whenever you will insert that pen drive again step 1 is not necessary.you can see it by opening usbstor.inf file in notepad.it is also possible to remove a selected drive,say,sony by deleting particular lines from this inf file before any sony drive has ever been connected to the PC & after doing this i think even after doing step 1&2 you won't be able to use sony drive on that particular PC.also to further complicate the matters one can assign special domain level write privileges on this inf file to restrict user from editing this inf file even if they do have admin rights on their PC.

P.S.how about giving this suggestion to your network admins just4kix!just kidding

@whitestar_999, regarding your suggestion. You must be kidding big time.

don't worry just4kix!i don't think any network admin is going to take so much trouble unless he has a grudge towards pen drives.anyway just keep my previous post handy.who knows you might need it yourself in near future?

hey i just checked manufacturers list in usbstor.inf & there was no name for transcend or kingston. i assume this list inserted by windows. then how come it allows other drives like transcend or kingston? i was expecting their names atleast somewhere in whole .inf.

For unlisted drives, it first load the generic USB driver and then searches the proper driver in the special (system) folder of the USB stick.

Nice piece of work alongwith screenshots good job:thumbup:

@just4kix

The steps which u mentioned is the exact process what i'm doing in our office. nice and surprised to see it posted here. really usefull tips for many.

P.s: the step 2 is not necessary in my company.(enabling in registry). i only do the step 1 and get the access.

good info j4k.............
u rock!

Sometimes, inspite of the above methods, a new USB mass storage device cannot be installed. This is because access to 'usbstor.inf / usbstor.pnf' has been permanently disabled. No amunt of admin priveleges can make the access possible.

In this case, login in safe mode as local administrator. Plug in the device. You should now be able to install the new USB device.

best way is Bribe your admin :P

best way to go flash on admined compy,... thanks j4k..

Originally Posted by talktoanil

best way is Bribe your admin :P

Or arrange a "contract" on him/her.

Thanks, mickey.

Provided Good Info.

Really a great thanks for the post.I will definitely try this at my office ,as they have blocked the USB mass storage.

I have done both the steps still my USB is not working

this is good information......works well on my pc having the same problem...both steps
but the question is ...is it necessary to do step 1?....

Thanx

i don't have usbstor.inf and usbstor.pnf in my off. comp,so i took those files from my home pc and copied it (both pc has win xp).do both steps but srill its not working. please suggest any other method or procedure.

Originally Posted by nil_vip2000

i don't have usbstor.inf and usbstor.pnf in my off. comp,so i took those files from my home pc and copied it (both pc has win xp).do both steps but srill its not working. please suggest any other method or procedure.

Do you have admin rights on the office PC?

i have done everything under admin login only.

its very use full tips u given i really want to appreciate i was just hitting my head of usb problem in my office i install some software to all office pc and our boss is left the job i got problem last was to format th all office pc but u given solution it help my job thanks alot..............

Here the problem is everything has been blocked. I can't either edit the .inf files or changing files permission to everyone and even I can't change the admin password also so please I'm requesting you if possible let me know any better solution. Thank you in advance.

USB ports are blocked because companies fear that:

- people might steal valuable information
- it will serve as a gateway for viruses

Many clients also insist on all kinds of security policies.

As regards to your query, I am sorry to say that unless you have admin rights, there is not anything one can do.

Sent from my GT-I9100G using Tapatalk 2

in regedit u can unblock find usbstor make it to 3
hkey lacal machine\system\current controlset\service\usbstor u will find start double click on it make it to 3

Originally Posted by nayazuddin

in regedit u can unblock find usbstor make it to 3
hkey lacal machine\system\current controlset\service\usbstor u will find start double click on it make it to 3

That alone may not do the trick. Read my first post. Need admin rights to edit registry.

Question? will this work on GPO Applied Policies, where you insert a usb and it prompts you to enter admin password, as i do have admin rights, but when i enter the password, it pops up a driver hardware, telling us to install the certain usb driver, but when i click the install, it searches and fails, so i'm assuming that at this point we need to do the first step, is that right? also, when we do the first step, by creating the option "everyone" as shown in the steps, will it appear in admins system or does it grab admins attention, coz you see i'm a junior systems admin and perhaps i'd like to do this on only my office pc and i don't want my admin to know about it, as my pc falls under users pc, so, will it affect on other PC's, too, as we are under the Group Policy.

hi
tnx for win xp

what about windows 7?
in domains?
i have admin access to my pc but under domain group policy the usb drives and cd/dvd roms are disabled
could any body help me?

Great Thread. Helped a lot in enabling the disabled USB ports. Thanks for the post.

Originally Posted by seyyedali

hi
tnx for win xp

what about windows 7?
in domains?
i have admin access to my pc but under domain group policy the usb drives and cd/dvd roms are disabled
could any body help me?

Windows 7 will not be a great lot different.

Sent from my GT-I9100G using Tapatalk 2

I have done the settings as said in Part 1 & Part 2. Still unable to access. I tried Portable Seagate HDD & 16GB HP pen drive. No luck.
Any suggestions pls. I think it is disabled by Symantec.