Block Storage Access, Not Every USB Peripheral
USB storage control should focus on removable data channels. Disabling every USB controller can also interrupt keyboards, mice, webcams, printers, and other devices that are unrelated to file copying.
Choose the Right Blocking Level
| Your goal | Recommended control | What remains available |
|---|---|---|
| Prevent data from leaving the PC | Disable writing to USB disks | USB storage may remain readable, depending on policy. |
| Prevent any USB storage use | Disable reading and writing | Keyboard, mouse, and unrelated peripherals can remain available. |
| Block personal drives but allow company drives | Default restriction plus trusted-device whitelist | Only approved USB storage remains usable. |
| Apply the same rule to managed Windows PCs | Group Policy, MDM, or endpoint device control | Behavior depends on Windows edition, licensing, and policy scope. |
- Install and open GiliSoft USB Lock, then enter the administrator password.
- Open USB & CD Lock from the Control Center.
- Select Disable Reading USB Disk, Disable Writing to USB Disk, or both, according to the required policy.
- Apply the policy, reconnect a test flash drive, and verify the expected read and write behavior.
Allow Trusted USB Drives While Unknown Storage Stays Blocked
A blanket ban is not practical when staff still use approved encrypted drives, service media, or company-issued storage. In that case, keep the restriction active and add reviewed devices to the trusted-device whitelist.
- Connect one approved company USB drive.
- Click Add in the Trusted Devices White-list area.
- Repeat for each approved drive, then test an unknown drive.
- Use Export and Import when the same list is needed on other PCs.
- Press Windows + R, enter gpedit.msc, and open the Local Group Policy Editor.
- Go to the Removable Storage Access policy location shown below.
- Choose Removable Disks: Deny read access, Deny write access, or All Removable Storage classes: Deny all access.
- Enable only the required rule, run gpupdate /force when appropriate, reconnect the drive, and test the exact operation.
This route is relevant when the organization already uses Microsoft Defender for Endpoint and has staff who can maintain device groups, policy XML, deployment scope, and audit data. A default-deny policy needs carefully defined allow rules so required printers, phones, optical devices, and approved storage do not become collateral damage.
Useful controls
Allow or deny removable-media groups and control read, write, and execute operations.
Operational cost
Requires compatible licensing, deployment tooling, policy maintenance, testing, and incident review.
What it controls
Whether Windows may install devices that match specified instance IDs, device IDs, setup classes, or the removable-device category.
What it does not replace
An installation rule is not the same as an access rule for devices already installed. Test existing hardware as well as a newly introduced drive.
Compare USB Storage Blocking Methods
| Method | Separate read/write rules | Trusted-device list | Best fit |
|---|---|---|---|
| GiliSoft USB Lock | Yes | Yes | Office, school, shared, and managed Windows PCs |
| Group Policy | Yes, by storage class | Requires additional device policies | Windows Pro/Enterprise policy administration |
| Defender Device Control | Yes | Yes, through device groups | Organizations already using Defender for Endpoint |
| Device Installation Restrictions | No | Yes, by device identifiers | Controlling which new devices Windows may install |
Verify the USB Storage Policy
Test reading
Open a file on an unapproved USB drive and confirm the configured read restriction.
Test writing
Copy a harmless test file to the USB drive and confirm the configured write restriction.
Test trusted devices
Connect an approved drive and confirm it receives only the intended permissions.
USB Storage Blocking FAQ
Can I block USB storage without disabling my keyboard and mouse?
Yes. Use storage-specific read/write controls instead of disabling USB controllers or hubs.
Can I block copying files to USB but still read the drive?
Yes. A write restriction targets copy-out activity while read access can remain available.
Can approved company USB drives remain usable?
Yes. Add reviewed drives to the trusted-device whitelist and test both approved and unknown devices.
Does USB storage blocking encrypt the files on a drive?
No. Blocking controls access on the PC. Use USB Encryption when files on the drive itself need password protection.
Windows Policy References
The Windows methods in this guide were checked against Microsoft documentation for Removable Storage Access, Device Installation Restrictions, and Defender Device Control. These references explain the policy scope; the GiliSoft steps and screenshots describe the USB Lock workflow.
