Removable storage devices, primarily USB flash drives and external hard drives, are a double-edged sword in an enterprise IT environment. While they make transferring large files easy, they are the number one vector for data exfiltration (employees copying sensitive company data and walking out the door) and malware injection (an infected flash drive executing a malicious payload the moment it is plugged in). In highly secure environments—such as banks, hospitals, or government agencies—allowing standard users to mount external drives is an unacceptable security violation.
This guide explains how to completely disable access to Removable Storage classes (USB drives) in Windows 11 using the Group Policy Editor.
Disable Removable Storage via Group Policy
To enforce a strict lockdown that prevents the operating system from reading or writing to any removable mass storage device, we must use a dedicated administrative template. Note that the Group Policy Editor is only available on Windows 11 Pro, Enterprise, and Education editions.
- Log into Windows 11 with an Administrator account.
- Press the Windows Key + R to open the Run dialogue box.
- Type
gpedit.mscand press Enter to launch the Local Group Policy Editor. - In the left-hand navigation pane, drill down to the following path:
Computer Configuration > Administrative Templates > System > Removable Storage Access - In the right-hand pane, locate the master policy named All Removable Storage classes: Deny all access.
- Double-click the policy to open its configuration window.
- Select the radio button next to Enabled. (You must “Enable” the restriction to deny access).
- Click Apply, then click OK.
Verify the Lockdown
Group policy changes typically apply instantly, but you can force an update by opening Command Prompt and running gpupdate /force.
To verify the restriction is active, insert a standard USB flash drive into an available port on the machine. Windows will still detect the hardware at the device level, but it will refuse to mount it for user access.
If you open File Explorer and attempt to double-click the newly inserted USB drive, the operating system will instantly block the action and display an “Access is denied” error message. The user is completely prevented from reading files off the drive or writing data to it, effectively neutralizing the USB port for data transfer while still allowing USB keyboards and mice to function normally.