GFI LANguard Portable Storage Control 2.0

To limit your company's exposure to the risks that portable storage devices pose, GFI Software's GFI LANguard Portable Storage Control (P.S.C.) lets you control user access to three classes of storage device: diskette drives; CD-ROM and DVD drives; and portable USB and FireWire-based storage devices. You can deploy and administer GFI LANguard P.S.C. remotely and use Active Directory (AD) group membership to control access to each of the three storage classes.

GFI LANguard P.S.C. supports Windows Server 2003, Windows XP, and Windows 2000 and runs as a 1.2MB agent on each protected machine. You install GFI LANguard P.S.C. first on a workstation that you use to configure the program, then deploy it to other computers. The agent installed quickly and painlessly in my testing.

For each of the three storage classes, GFI LANguard P.S.C. lets you specify a list of users and groups. You can configure the software to either grant or deny access to those users and groups. You must redeploy the product when you change a list's grant or deny permission, but not when membership in a group changes. Therefore, altering group membership is the recommended way to change grant and deny access to a device class. Users with administrative authority, such as members of the Administrators and Power Users local groups, can kill the process or stop the GFI LANguard P.S.C. service, circumventing GFI LANguard P.S.C.'s protection. Although you can use Group Policy to manage user rights for individual services, doing so doesn't prevent an administrative user from killing a process.

To deploy the GFI LANguard P.S.C. agent, you can select from the list of computers that GFI LANguard P.S.C. detects online or supply the NetBIOS names or IP addresses of target computers. Deployment proceeds quickly, and GFI LANguard P.S.C. notifies users of the need to reboot their computer. It took me only a few minutes to deploy the GFI LANguard P.S.C. agent to systems running Windows 2003, XP Service Pack 2 (SP2), and Win2K. I tested access to a standard USB keychain-style storage device and to the storage card in a digital camera. I was denied or allowed access appropriately, depending on whom I logged in as. The software didn't interfere with access to a FireWire-connected scanner. Overall, GFI LANguard P.S.C. is easy to install and configure and will restrict access to portable storage media for nonadministrative users.

—John Green