Which USB Setting Blocks File Copying?
The direction matters. When a user drags a local document to a flash drive, Windows writes new data to the removable disk. A write restriction stops that action, along with editing, renaming, or deleting files on the USB drive. Existing USB files can remain readable.
Choose the Correct Copy Direction
| What you need to stop | Control to apply | Expected result |
|---|---|---|
| PC files copied to USB | Disable writing to USB/SD storage | The drive can be opened, but users cannot add, edit, rename, or delete files on it |
| USB files copied to the PC | Disable reading from USB storage | Files on the removable drive cannot be opened or copied into Windows |
| Unknown drives only | Block unapproved storage and whitelist issued drives | Company drives keep their assigned access; personal and unknown drives remain restricted |
| Phone and portable-device transfer | Restrict Android, iPhone, or Windows Portable Device access | File transfer through phones and media devices follows the configured policy |
Ways to Block USB Copying on Windows
Choose the exact USB read or write restriction, keep approved drives available, protect settings with a password, and review activity from one Windows interface.
On supported Windows editions, enable Removable Disks: Deny write access under Computer Configuration > Administrative Templates > System > Removable Storage Access.
Organizations using the required Microsoft endpoint stack can create granular read, write, and execute rules for removable media and selected device groups.
Windows can require removable drives to use BitLocker before they receive write access. This controls which encrypted drives may accept data rather than blocking every copy operation.
For a small or medium Windows deployment, GiliSoft USB Lock keeps the task direct. Administrators can block USB writing without building XML policy groups, collecting device identifiers, or applying a broad rule to unrelated peripherals.
Block PC-to-USB Copying with GiliSoft USB Lock
Stop write operations without hiding the whole drive
Disable writing to USB disks so existing files can still be viewed, then add trusted company drives when approved transfer jobs must remain available. USB Lock also provides read restrictions, SD-card control, phone-transfer controls, activity monitoring, and protected administration.
How to Stop Files from Being Copied to USB
- Install GiliSoft USB Lock on the Windows PC, create the administrator password, and configure the recovery email.
- Open USB & CD Lock from the left navigation.
- Select Disable Writing to USB Disk. Add Disable SD Card Reader when the same copy-out rule should cover removable memory cards.
- Apply the setting and reconnect the test drive if Windows does not refresh its access immediately.
- Copy a harmless test file from the desktop to the USB drive. Confirm Windows refuses the write operation while an existing USB file still opens.
- Add only approved company drives to the trusted-device list when selected transfer jobs need read-write access.
- Open USB Monitor, enable monitoring, and review events after the test.
Verify the Policy Before Deployment
- Copy a local document to an unknown USB drive: the write must be blocked
- Open a file already on the USB drive: it should work when read access remains enabled
- Try to rename or delete a USB file: both operations should follow the write restriction
- Connect an approved company drive: verify its assigned read-only or read-write permission
- Reconnect the drive after restart: confirm the same policy remains active
- Review USB Monitor or access records: confirm the test appears as expected
Test with disposable files and a noncritical drive first. Record the policy, the trusted-device list, and the expected result so another administrator can repeat the check later.
Where USB Copy Blocking Helps
Shared office and reception PCs
Users can read approved presentation, print, or support media without copying customer files, reports, or local records onto personal storage.
Finance, HR, and customer-service workstations
Blocking USB writes reduces casual copy-out of spreadsheets, identity records, contracts, and exported customer data while ordinary Windows work continues.
Schools, labs, kiosks, and production stations
Keep reference media readable, restrict unknown storage, and preserve read-write access only for named service or collection drives.
Large Windows deployments
GiliSoft can evaluate custom development and licensing for organizations that need specific device rules, administrator roles, reporting, deployment methods, or integration requirements.
Need USB copy control across many Windows PCs?
Send the endpoint count, Windows versions, transfer channels, approved-device list, required read/write behavior, logging needs, and deployment method. GiliSoft can assess licensing and custom development for the project.
Discuss a USB control deploymentUSB File Copy Blocking FAQ
Can I block copying to USB but still let users read the drive?
Yes. Disable USB writing and leave reading enabled. Users can open existing files, but cannot add, edit, rename, or delete data on the drive.
Can approved USB drives remain writable?
Yes. Add issued company drives to the trusted-device list and give each one the required permission. See the USB whitelist software guide for inventory and deployment advice.
Does this also cover SD cards?
Yes. GiliSoft USB Lock includes an SD-card reader restriction, so removable memory cards can follow the same transfer policy.
Can USB Lock restrict phone file transfer?
Yes. It includes Android and iPhone controls for organizations that also need to manage mobile-to-PC transfer paths.
Does blocking USB copying encrypt the drive?
No. Access control governs transfer on the protected Windows PC. Use GiliSoft USB Encryption when the files stored on the drive also need a password-protected private area.
What is the difference between this page and USB whitelisting?
This page focuses on stopping write operations to removable storage. Whitelisting focuses on keeping individually approved drives available while unknown storage remains restricted. The two controls can be used together.
Research Sources
- Microsoft Learn: Storage Policy CSP and Removable Disks deny-write policy
- Microsoft Learn: Device Control in Microsoft Defender for Endpoint
- Microsoft Learn: Deploy Device Control with Group Policy
- Microsoft Learn: Configure BitLocker removable-drive policies
- CISA: Risks of portable devices
Stop files from being copied to USB drives
Block removable-storage writing, keep approved company drives available, and review USB activity with GiliSoft USB Lock.