Windows policy settings: overriding machine settings for specific user

Question

I want use windows policy setting to limit access to removable media.

This can be done by setting

[HKEY_USERS\<uid>\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices]
"Deny_All"=dword:00000001

for limiting a specific user

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices]
"Deny_All"=dword:00000001

for all users on the machine.

I'm looking for a method to limit all users, with the exception of one specific local user. However, the limitation appears to be additive - there is no way (that I know of) to define an exception for a specific user.

Is there some kind of alternative?

Answer 1

This is confusing: "the limitation appears to be additive - there is no way (that I know of) to define an exception for a specific user." I am not sure what you mean because you should be able to define exceptions.

Log in as the user, and set his specific HKEY_CURRENT_USER registry entry to allow him to access USB devices by turning off the entry. If he is not an admin, this registry entry will not save, so you will have to either give him admin rights, even if only while you make the change (log out and log back in if you do make him an admin), or log in as an administrator, and find his hive under HKEY_USERS and change it there as an admin.

You will need to set all the others, who currently have profiles not to allow it.

Now, to set it for all future users, navigate to

HKEY_USERS.DEFAULT\Software\Policies\Microsoft

the key structure probably ends here, so add the rest, including the "Deny_All" DWORD value. Any new users logging in, will get that setting.