Why Disable USB Storage?

USB drives are a major security risk - they can spread malware and be used to steal sensitive data. Group Policy lets you disable them company-wide.

Step 1: Open Group Policy Management

  1. On your domain controller, open "Group Policy Management"
  2. Right-click your domain or OU ? Create a GPO in this domain
  3. Name it "Disable USB Storage"
  4. Right-click the new GPO ? Edit

Step 2: Configure the Policy

Navigate to:

Computer Configuration ? Policies ? Administrative Templates ? System ? Removable Storage Access

Enable these settings:

  • "Removable Disks: Deny read access"
  • "Removable Disks: Deny write access"
  • "Removable Disks: Deny execute access"

Step 3: Link the GPO

Link the GPO to your target OU containing the computers you want to protect.

Step 4: Force Update

On client computers, run:

gpupdate /force

Exceptions for IT Staff

Create a separate OU for IT staff computers and don't link this GPO to it, allowing your team to use USB drives when needed.

Alternative: Read-Only Access

Instead of blocking completely, you can allow read-only access by only enabling "Deny write access".