The Threat of Removable Storage
From an IT security perspective, USB flash drives are one of the most dangerous threat vectors in a corporate environment. A disgruntled employee can easily copy gigabytes of sensitive intellectual property onto a thumb drive in seconds. Conversely, an employee might unknowingly plug in an infected USB drive they found in the parking lot, unleashing ransomware directly past your network firewalls. Group Policy (GPO) allows you to universally block all removable storage devices across your entire Windows domain with just a few clicks.
Step 1: Create a New Group Policy Object
Log in to your Domain Controller and open the Group Policy Management Console (GPMC).
Expand your domain tree, right-click the specific Organizational Unit (OU) containing your user workstations (e.g., Workstations-OU), and select Create a GPO in this domain, and Link it here….
Name the new policy something clear, such as “Security – Block Removable Storage”, and click OK.
Step 2: Edit the Policy Settings
Right-click your newly created GPO and select Edit to open the Group Policy Management Editor.
Navigate through the tree to the following path:
Computer Configuration > Policies > Administrative Templates > System > Removable Storage Access
Step 3: Enable the Block Policy
In the right-hand pane, you will see a list of various removable storage classes (CDs, Tape Drives, WPD devices like smartphones).
To completely lock down all USB flash drives and external hard drives, double-click the policy named: Removable Disks: Deny read access.
Select the Enabled radio button. Click Apply and OK.
Next, double-click the policy named: Removable Disks: Deny write access.
Select the Enabled radio button. Click Apply and OK.
(Note: If you want to allow users to read files from USB drives, but prevent them from stealing data, you would only enable the “Deny write access” policy).
Step 4: Force the Group Policy Update
The policy is now active on the Domain Controller. Windows clients typically refresh their policies automatically every 90 minutes.
To test it immediately, log in to a client workstation located in the OU you linked the GPO to. Open the Command Prompt and force a background policy refresh:
gpupdate /force
Step 5: Verify the Block
After the gpupdate completes, physically insert a USB flash drive into the client workstation.
Windows will still detect the hardware, install the driver, and assign it a drive letter (like E:). However, when the user double-clicks the drive in File Explorer, they will immediately receive a pop-up error stating: “E:\ is not accessible. Access is denied.” The OS has successfully blocked all read and write I/O to the external bus.