SDCard Slot Lockdown/Lock?

[Matt]

Can anyone give me some good advice on how to handle locking down the SD card slot?

[dgreening]

Don't suppose you use Sophos? If so you can do it via the Device Control settings.

[Matt]

No needs to be using the JSS so either CP, MCX, or Scripted.

[davidacland]

Prior to 10.11 you could disable hardware elements by removing their kext files. It was a bit of a hack and possible for someone to workaround if they knew what had been done and had admin rights, but it worked.

10.11 protects that kind of stuff so I've only been able to achieve it with tools like Sophos device control or endpoint protector.

That being said, you can restrict removable media via a config profile in Restrictions > Media > External Disks. Not sure if it would be sufficient but thats the only option I can think of.

[Matt]

Apple labels the SD Card as an Internal Storage Device as opposed to Removable Media (REALLY GUYS!!!!) The only way to do this via CP is to disable Internal Storage. We don't use secondary drive so we enabled it. I told our Apple Corp. Rep about this and he forwarded it to the OS team. Seems like a stupid oversight with huge management side effects.

[Matt]

Any other options? People here must be blocking this!!! Our kext blocking was working fine until Mavericks and with the changes in KEXT management in El Cap what options exist! Blocking the internal media via Configuration Policy blocks the SD reader but also makes some of our machines boot to Prohibitory or ? Folders. Please any help on this we are being dinged hard on our audit because of this. It seems crazy to me that this SD Card reader is like an evil unicorn.

[CypherCookie]

I got around it by creating a custom script and launch agent.

They both sit at the computer level, and essentially check if the user is an admin or not. If they aren't the SD card will automatically unmount forcefully.

Thats the best method I have been able to come up with without going down the route of purchasing a 3rd party app to do it for me.

[bpavlov]

This is dirty but I've heard of people putting krazy glue in ports they want to block off. This ruins the aesthetics, but....

[CypherCookie]

yup i suggested the exact same idea and the looks of horror....