In a corporate or highly secure environment, the easiest way for someone to steal sensitive data (or introduce ransomware to a network) is by simply plugging a thumb drive into an unguarded computer. While you could physically glue the USB ports shut, that also breaks your ability to use USB keyboards and mice. The modern, elegant solution is to configure the Windows kernel to specifically block USB Mass Storage devices while leaving human interface devices alone.
By altering a specific key in the Windows Registry, you can instruct the operating system’s USB storage driver (USBSTOR) to refuse to load when a flash drive is inserted. The computer will completely ignore the drive, preventing any read or write access.
How to Completely Block Windows 11 USB Storage Devices
You must modify the USBSTOR driver startup type using the Registry Editor.
- Click the Start button, type regedit, and press Enter to open the Registry Editor. (Click “Yes” on the UAC prompt).
- In the left-hand navigation pane, carefully drill down through the folders to reach this exact path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR - Click once on the USBSTOR folder so it is highlighted.
- Look at the right side of the window. Find the entry named Start.
- Double-click on Start.
- The “Value data” will likely be set to
3(which means the driver is set to start manually/normally). - Change the “Value data” to exactly 4. (The value 4 means the service is permanently disabled).
- Click OK.
Close the Registry Editor. Crucially, you must restart your computer for this kernel change to take effect.
Once Windows 11 boots back up, plug a USB thumb drive into the computer. You will hear the standard hardware connection chime, but the drive will never appear in File Explorer or Disk Management. The operating system actively refuses to mount the filesystem, permanently securing your PC against rogue data transfers. (If you ever need to use a flash drive again, simply change the Registry value back to 3 and reboot).