Group Policy SearchGroup Policy Search
English

Prevent writing to USB drives with Group Policy

You can use Group Policy to prevent files from being written to removable USB drives. The Removable Disks: Deny write access policy denies write access to the removable disk storage class when set to Enabled; it does not block reading or every USB device. The corresponding Storage Policy CSP setting has device scope and supports Windows 10 1809 or later on Pro, Enterprise, Education and IoT Enterprise. A separate BitLocker policy can deny write access to removable data drives that are not protected by BitLocker.

What to check after applying the policy

This policy helps reduce unauthorized copying of data from a computer to removable USB storage; it does not prevent every route of data exfiltration. Saving, modifying, deleting, or copying files to a removable disk may fail when it is enforced. Write protection can also result from a physical switch or a domain GPO. If local changes revert, check domain policy and contact the administrator. If access is denied when opening the drive, check for separate read restrictions, other security settings, and the device's condition.

Steps

  1. Open gpedit.msc and navigate to Computer Configuration › Administrative Templates › System › Removable Storage Access under Computer Configuration.
  2. Open Removable Disks: Deny write access, select Enabled, and apply the change.
  3. Check the applied policy and try copying a file to a removable disk. A domain GPO can override a local setting; an administrator may need to change it.
  4. To restore write access under this policy, select Disabled or Not Configured. Other security settings or the device state can still restrict access.

Registry alternative

You can also set the computer policy value in the registry. This is separate from StorageDevicePolicies\WriteProtect. See the registry value page.

HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Deny_Write (REG_DWORD)
1 = enabled
0 = disabled

Under this policy, a Deny_Write DWORD of 1 denies writing; 0 allows writing.

  1. Open regedit with administrator permissions. Back up the existing target key, or an existing parent key if the target is absent. Note whether Deny_Write exists and, if so, its current type and value.

    In Registry Editor, select the existing target key, or an existing parent key if the target is absent, then choose File > Export, choose a location and file name, and save the .reg backup.

  2. Create any missing keys and the Deny_Write DWORD value as needed, then set its data to 1. Check the applied policy and test copying a file to a removable disk.

  3. To undo the change, restore the previous value and type if it existed; otherwise delete only the newly created Deny_Write value. Leave other values and keys intact.

A domain policy can reapply and override manual changes. If a GPO controls the setting, use the policy editor or contact the administrator. A manually set 0 is not the same as the Group Policy not-configured state.

Baseline: Windows 11 version 26H2 policy templates (checked 2026-11-04).

References