How to Deny Removable Storage Access in Windows 11

This guide explains how to block or allow USB drives and other removable storage on Windows 11.

Why Deny Removable Storage Access?

USB drives are convenient, but they are a major security risk. They can carry malware or viruses that infect your system the moment you plug them in. By restricting removable storage access in Windows 11, you prevent unauthorized data copying and protect your computer from malicious files.

What Happens When You Restrict Access?

When you enable these restrictions, Windows will ignore any USB mass storage class device you connect. You will not see the drive in File Explorer. If you try to access it, you will receive an “Access Denied” error. This setting does not affect essential peripherals like wireless mice or keyboards.

Using Group Policy to Block USB Drives

Note: This process requires administrator privileges and is only available on Windows 11 Pro or Enterprise editions.

1. Press Win + R, type gpedit.msc, and hit Enter.

2. Navigate to: Computer Configuration > Administrative Templates > System > Removable Storage Access.

3. Find All Removable Storage classes: Deny all access in the right pane.

4. Double-click it, select Enabled, and click OK.

5. To revert, select Not configured.

Registry Editor Method for Windows Home

Note: This process requires administrator privileges. Always back up your registry before making changes.

If you have Windows 11 Home, you must use the Registry Editor.

1. Press Win + R, type regedit, and hit Enter.

2. Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices.

3. If the key does not exist, right-click Windows, select New > Key, and name it RemovableStorageDevices.

4. Right-click the new key, select New > Key, and name it {53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.

5. Right-click in the right pane, select New > DWORD (32-bit) Value, and name it Deny_Read. Set its value to 1.

6. Repeat for Deny_Write if you want to block saving files.

Best Practices for Administrators

• Always test policies on a single machine before deploying to a network.
• Use Deny write access if you want to allow users to read files but prevent them from stealing sensitive company data.
• Document all changes made to the registry or GPO to avoid confusion during troubleshooting.

Summary

Restricting removable storage is a vital step for data loss prevention. Whether you use the Group Policy Editor for professional editions or the Registry Editor for Home editions, you can effectively block unauthorized USB access. Always remember that these settings require administrator privileges to configure.” }