Deny Write Access to Unprotected Removable Drives in Windows 11

What is BitLocker?

BitLocker is a Windows security feature that encrypts files, meaning only people with the correct key can read them. It protects critical data on your computer’s main drive, the Windows system itself, and also on USB sticks and other removable drives. BitLocker secures various types of storage on your system. It protects USB drives and other removable media, fixed internal drives, and your main Windows operating system drive.

BitLocker protects:

• USB drives and other removable drives
• Fixed drives inside your PC
• Your Windows operating system drive

When BitLocker Drive Encryption runs on the Windows 11 system drive, the computer can unlock it automatically during startup. That automation removes the need for manual password entry every single time the PC begins booting up.

Why Deny Write Access to Unprotected Drives?

Saving files to drives secured with BitLocker protects your information. This BitLocker security prevents accidental saving to unsecured drives, reducing data risk.

How to Deny Write Access Using Local Group Policy Editor

Follow these steps:

Step 1Open the Local Group Policy Editor

1. Click the Start button
2. Type Edit group policy and press Enter

Step 2Navigate to the BitLocker Settings

In the window that opens, navigate to this location:

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Removable Data Drives

Step 3Find and Change the Setting

To deny write access to removable drives not protected by BitLocker, locate a specific setting within Windows. This setting, named 'Deny write access to removable drives not protected by BitLocker,' is crucial for preventing users from saving files to unencrypted USB drives.

Step 4Choose Your Option

To deny write access to unprotected removable drives, select the 'Enabled' option when configuring the restriction. This setting instructs Windows that only BitLocker-protected drives can be written to, effectively making all other drives read-only by default.

• Not Configured (default) – Same as disabled. No restrictions.
• Enabled – You can only write to drives protected by BitLocker. Unprotected drives become read-only (you can view files, but not save new ones).
• Disabled – You can write to all removable drives, whether protected or not.

Select Enabled to protect your data.

Step 5Save and Restart

Click OK to save your changes.

Restart your PC to apply the changes.

Extra option: Enabling this setting also allows you to permit write access solely to devices configured by your organization. This option works particularly well in corporate or school environments.

How to Deny Write Access Using Windows Registry Editor

Editing settings in the Windows Registry (a central hierarchical database that stores low-level operating system settings) enables users to deny write access to unprotected removable drives. Backing up the Windows Registry before making changes remains vital, because incorrect edits can cause system instability. Administrative privileges are required for this action.

Step 1Open the Registry Editor

1. Press Windows + R keys to open the Run box
2. Type regedit and press Enter

Step 2Go to the First Registry Path

Navigate to this path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

Step 3Create or Edit RDVDenyCrossOrg

Look for a value named RDVDenyCrossOrg. If it's not there, create it:

1. Right-click the right side of the window
2. Click New → DWORD (32-bit) Value
3. Name it RDVDenyCrossOrg

Double-click RDVDenyCrossOrg and set its value data to 1 to deny write access to unprotected drives.

Step 4Go to the Second Registry Path

Next, navigate to this path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

Step 5Create or Edit RDVDenyWriteAccess

Look for RDVDenyWriteAccess. If it's missing, create it using the same method.

Double-click RDVDenyWriteAccess and set its data to 1 to deny write access.

Step 6Close and Restart

After modifying the Registry settings to deny write access to unprotected removable drives, close the editor and restart your computer. Re-enabling writing to all drives requires removing the specific registry values added to block file changes.

Permitting writing to all drives again involves deleting those two specific registry values. This action reverts the security setting that blocked file changes on removable drives, restoring normal functionality for user data and software installation on USB sticks or external hard drives.

Summary

Denying write access to unprotected removable drives in Windows 11 can be accomplished using either the Local Group Policy Editor or by editing the Registry. This security measure ensures that only BitLocker-protected drives permit file saving, thereby enhancing your data security against unauthorized access.

Administrators can configure this setup using the Local Group Policy Editor, or by modifying the Registry directly.

Denying write access to unprotected removable drives in Windows 11 keeps personal files safer and reduces the risk of unwanted data being saved to those drives, particularly when using a drive without built-in security features.

Anyone wanting to learn more about BitLocker can check out this helpful guide: How to Turn On BitLocker in Windows 11.