Deny Write Access to Unprotected Removable Drives in Windows 11

What is BitLocker?

BitLocker is a built-in Windows security tool that encrypts your files so only people with the right password or key can open them. It protects everything from your main operating system drive to internal storage and removable USB drives, keeping your personal data safe if your computer or hardware is ever lost or stolen.

BitLocker protects:

• USB drives and other removable drives
• Fixed drives inside your PC
• Your Windows operating system drive

When BitLocker Drive Encryption runs on the Windows 11 system drive, the computer can unlock it automatically during startup. That automation removes the need for manual password entry every single time the PC begins booting up.

Why Deny Write Access to Unprotected Drives?

Requiring BitLocker encryption stops you from accidentally saving sensitive files to unsecured drives.

How to Deny Write Access Using Local Group Policy Editor

Follow these steps:

Step 1Open the Local Group Policy Editor

1. Click the Start button
2. Type Edit group policy and press Enter

Step 2Navigate to the BitLocker Settings

In the window that opens, navigate to this location:

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Removable Data Drives

Step 3Find and Change the Setting

To deny write access to removable drives not protected by BitLocker, locate a specific setting within Windows. This setting, named 'Deny write access to removable drives not protected by BitLocker,' is crucial for preventing users from saving files to unencrypted USB drives.

Step 4Choose Your Option

To deny write access to unprotected removable drives, select the Enabled option in your policy settings. This tells Windows to block file saving on any external storage that lacks encryption, which stops people from copying new files onto unapproved USB sticks while still letting them open existing files.

• Not Configured (default) – Same as disabled. No restrictions.
• Enabled – You can only write to drives protected by BitLocker. Unprotected drives become read-only (you can view files, but not save new ones).
• Disabled – You can write to all removable drives, whether protected or not.

Select Enabled to protect your data.

Step 5Save and Restart

Click OK to save your changes.

Restart your PC to apply the changes.

Extra option: Enabling this setting also allows you to permit write access solely to devices configured by your organization. This option works particularly well in corporate or school environments.

How to Deny Write Access Using Windows Registry Editor

You can also use the Windows Registry (a database for low-level system settings) to block write access to unprotected drives. Backing up the Windows Registry before making changes remains vital, because incorrect edits can cause system instability. Administrative privileges are required for this action.

Step 1Open the Registry Editor

1. Press Windows + R keys to open the Run box
2. Type regedit and press Enter

Step 2Go to the First Registry Path

Navigate to this path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

Step 3Create or Edit RDVDenyCrossOrg

Look for a value named RDVDenyCrossOrg. If it's not there, create it:

1. Right-click the right side of the window
2. Click New → DWORD (32-bit) Value
3. Name it RDVDenyCrossOrg

Double-click RDVDenyCrossOrg and set its value data to 1 to deny write access to unprotected drives.

Step 4Go to the Second Registry Path

Next, navigate to this path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

Step 5Create or Edit RDVDenyWriteAccess

Look for RDVDenyWriteAccess. If it's missing, create it using the same method.

Double-click RDVDenyWriteAccess and set its data to 1 to deny write access.

Step 6Close and Restart

After you finish editing your registry settings to deny write access to unprotected removable drives, close the window and restart your computer. This forces Windows to apply your new security rules so that external USB drives immediately switch to read-only mode until you remove the block.

To allow write access only to devices from your organization, set both RDVDenyCrossOrg and RDVDenyWriteAccess to 1.

Permitting writing to all drives again involves deleting those two specific registry values. This action reverts the security setting that blocked file changes on removable drives, restoring normal functionality for user data and software installation on USB sticks or external hard drives.

Summary

Denying write access to unprotected removable drives in Windows 11 helps protect your computer from unknown USB sticks and data leaks. You can set this up using either the Local Group Policy Editor or the Registry Editor to make sure Windows only lets you save files to secure, encrypted storage.

Administrators can configure this setup using the Local Group Policy Editor, or by modifying the Registry directly.

Denying write access to unprotected removable drives in Windows 11 keeps personal files safer and reduces the risk of unwanted data being saved to those drives, particularly when using a drive without built-in security features.

Anyone wanting to learn more about BitLocker can check out this helpful guide: How to Turn On BitLocker in Windows 11.