Questions[removable-storage](server)

We have an environment where multiple regular users share a single windows 2012 R2 server via RDP as their "workstation". I'd like to allow them to use an attached CD burner from time to time.

I've followed the instructions here: https://technet.microsoft.com/en-us/library/cc731422(v=ws.10).aspx for enabling All Removable Storage: Allow direct access in remote sessions, but it does not seem to work.

The disc drive for users and even users in the Administrators group shows up, but does not show the progress bar icon under the drive indicating it is writable. It does not make a difference if logged in locally via KVM or through RDP.

When they double click on the drive icon it shows:

Windows can't read the disc in drive E:\ Make sure that the disc uses a format that Windows recognizes...

If I log in as the "Administrator" (Local or Domain), or if I kill all my explorer.exe processes and start one new from the elevated command prompt the drive shows up as one would expect. This works locally via KVM or via RDP.

When I log in as an administrative user via RDP or even local on the KVM the only way I can see the CD Burner dialogue is if I am the "Administrator" user or if I kill all explorer.exe processes for myself and start a new one from an elevated prompt.

I've done all I can think of in terms of setting the group policy from our domain controller, un-setting it at the DC and setting it locally on our server, rebooting between each change, and still regular users can't burn discs!

I know there must be a way because it works how I want on another network we use but the group policy settings there are what I would expect the All Removable Storage: Allow direct access in remote sessions is enabled and there are no configured values for the "Deny..." device options.

Any tips here would be appreciated as it is driving me crazy that it works on one of our networks but not the other!

So I've been looking at ways to audit when a form of external media performs writes/ uploads on a Linux system. Currently the main solution I have come across is to simply audit when the mount and unmount syscalls occur, as tracking writes may excessively fill the log files (this should not be a problem for my situation). My current attempt at reading writes from external media is as follows:

-w /media/ -p rwxa -k external_media

However I found that this solution doesn't work since -w does not travel into newly inserted mounted directories. I also looked into the -q option, but since I won't know the name of the mounted directory beforehand, I don't know how to give the -q option the subtree/ mount directory name. Any ideas?

TL;DR In auditd, is there a good way to refresh a rule's watch directory when a new mount point is placed inside said directory?

UPDATE: I'm attempting to use -R /etc/audit/audit.rules in my mounting rule so that whenever I find a new mount/ unmount my rule list will be reapplied with the watched directory including the subtrees of the mounted directory, but I am given the following error

Error - nested rule files not supported

Which I am assuming is because I'm trying to -R /etc/audit/audit.rules inside that very same file, though I could be wrong. Is there a workaround for this so that rules can be reapplied automatically upon some audit event occurring? I'm not sure if this will fix the problem, however, because I do not know if -R will actually enforce the new rules right away, or will wait until the auditd service is restarted instead.

First, the situation: I've got a Linux computer with two eSATA drive bays that accept removable SSD drives. I'm trying to write a little GUI application that makes it easier for the user to mount/unmount/format/backup/etc the drives that he puts into these bays.

It all mostly works. One small problem, however, is that I don't know how to find out any information about what's on the inserted drive(s) until after the drives have been successfully mounted.

So, for example, if the user inserts a drive that I can't mount (e.g. because it is unformatted, or formatted with an unexpected filesystem), all my app can say about it is "Drive failed to mount".

This isn't very satisfactory, because if the drive is unformatted, the user will probably want to format it... but if the drive contains data from an unrecognized filesystem, the user will probably NOT want to format it.... or at least, I want to be able to warn him that by doing so he'll be erasing potentially valuable data.

So my question is: is there any method for querying some basic information (especially filesystem-type) from a drive that doesn't require that the drive already be mounted? Or do I just have to try to mount it with various known filesystems until one of the mount attempts succeeds, and give a vague "be careful" message if none of them do?

In case it matters, the paths I use to mount the drives in the drive bays are:

/dev/disk/by-path/pci-0000:00:1f.2-scsi-2:0:0:0
/dev/disk/by-path/pci-0000:00:1f.2-scsi-1:0:0:0

I am currently editing a GPO for user accounts of a particular OU and I want to disable removable drives access on a particular OU, problem is that all the client machines are Windows XP and the currently available policy works for clients that have Vista or above.

How do I achieve this without having to manually go around all the machines and setting the local computer policy to not allow access to removable drives (which will be my last ditch effort if nothing else works but its going to be a big headache)?

We've run into a number of issues on our system where students are unplugging devices from workstations without safely removing them first. Whilst the results are often a very good learning experience (corrupted USB disks) it would be nice if it was possible to enforce the "no write cache" policy for removable drives through group policy.

A quick search through the available administrative templates shows nothing for this purpose though. Are there any solutions to this problem apart from locally configuring each machine?

Our domain controller is running Server 2003 R2 and the workstations all run XP SP3.