How to Disable USB Storage Access on Windows

Q: Can I disable USB storage without disabling keyboards and mice?

Yes. Apply removable-storage rules instead of disabling the entire USB controller, then test every required keyboard, mouse, printer, and peripheral.

Q: What is the difference between deny read, deny write, and deny all?

Deny read prevents users from opening or importing files from removable storage. Deny write prevents copying files from the PC to the drive. Deny all blocks both directions.

Q: Can approved USB drives still work when unknown storage is blocked?

Yes. GiliSoft USB Lock can place verified company drives on a trusted-device whitelist while unknown removable storage remains restricted.

Q: Can USB storage and phone transfer be controlled separately?

Yes. GiliSoft USB Lock provides separate controls for USB and SD storage, Android and iPhone data access, USB tethering, and CD or DVD media.

Disable the Storage Class, Not the Entire USB Controller

Quick answerFor most Windows PCs, disable removable-storage access rather than the USB controller. This blocks flash drives and external storage while keyboards, mice, printers, security keys, and other non-storage peripherals can continue working.

“Disable USB” is often too broad. A USB port can carry storage, input devices, printers, phones, cameras, network adapters, and charging. Before changing Windows, identify the operation you need to stop: opening files from a drive, copying files to it, using any unknown storage, or all removable-media access.

Deny writeUsers may open approved media, but cannot copy files from the PC to the drive.

Deny readUsers cannot open or import files from removable storage.

Deny all or whitelistBlock both directions, or permit only registered company drives.

Choose the USB Storage Access Level

Deny write access: stop PC-to-USB copying while allowing users to read approved files from the drive.
Deny read access: stop opening, importing, or running files from removable storage.
Deny all access: block reading and writing when no USB storage task is permitted.
Allow approved drives only: register trusted company media and reject unknown storage.
Control related channels: set separate rules for SD cards, Android and iPhone transfer, tethering, and optical media.
Record access attempts: verify that the restriction is working and investigate exceptions.

Do not judge the result only by drive visibility. A deny-read or deny-write policy may leave the drive letter visible in File Explorer while the restricted operation fails. Test opening a file, copying into the drive, copying out of it, reconnecting it, and restarting Windows.

Compare Ways to Disable USB Storage Access

Option	Good for	User experience	Important consideration
GiliSoft USB Lock Recommended	Direct storage control, trusted-drive whitelist, phone and media rules, and access logs	Unknown storage is restricted while approved devices remain usable	Password-protected settings; volume, OEM, and custom-development options available
Windows Group Policy or MDM	Managed read, write, or all-access restrictions	Windows rejects the configured removable-storage operation	Local Group Policy is normally unavailable on Windows Home
Microsoft Defender Device Control	Enterprise device groups, user conditions, granular permissions, and reporting	Access can vary by device, user, and machine	Requires eligible Microsoft licensing and experienced administration
Device Manager or USBSTOR	A simple local block on one PC	The storage device or driver is disabled	No approved-drive workflow or useful access history

Method 1: GiliSoft USB Lock

Block USB Storage and Keep Approved Drives Working

List every USB peripheral and removable drive that must continue working on the test PC.
Install GiliSoft USB Lock, create the administrator password, and configure recovery information.
Open the USB and CD/DVD controls, then select the USB/SD storage and related channels to restrict.
If approved storage is required, insert each verified drive and add it to the trusted-device whitelist.
Reconnect an unknown drive and confirm that Windows blocks the intended read or write operation.
Reconnect an approved drive, test normal access, and review the access log for both attempts.
Export the tested whitelist before applying the same configuration to additional PCs.

GiliSoft USB Lock USB storage access settings — Control USB and SD storage separately from phone transfer, tethering, and CD/DVD access.

GiliSoft USB Lock approved USB drive whitelist — Register approved drives so required company media remains available.

GiliSoft USB Lock removable-storage access log — Review allowed and blocked attempts after testing the rule.

Method 2: Windows policy

Disable Removable Storage with Group Policy

On supported Windows editions, open the Local Group Policy Editor and go to Computer Configuration > Administrative Templates > System > Removable Storage Access. Choose the narrowest policy that matches the requirement:

Removable Disks: Deny write access stops copying files from the PC to removable disks.
Removable Disks: Deny read access stops users opening or importing files from removable disks.
All Removable Storage classes: Deny all access applies a broader block across removable-media classes.
Managed deployment: use domain Group Policy or MDM instead of configuring each PC manually.

Open gpedit.msc with administrator rights.
Navigate to the Removable Storage Access policy folder.
Enable the required deny-read, deny-write, or deny-all setting.
Run gpupdate /force, reconnect the drive, and test both copy directions.

Method 3: simple local block

Use Device Manager or the USB Storage Driver Carefully

Device Manager can disable a specific USB storage device, while the USBSTOR service controls the Windows USB mass-storage driver. These methods can be useful on a single PC, but they are blunt controls: they do not provide a trusted-drive list, phone-transfer rules, exception handling, or a readable access history.

Avoid disabling USB host controllers unless the PC truly needs no USB devices. That can also interrupt keyboards, mice, printers, recovery media, and service equipment. Always keep a tested administrator recovery path.

GiliSoft recommendation

Use GiliSoft USB Lock When a Simple On/Off Switch Is Not Enough

GiliSoft USB Lock brings USB and SD storage control, trusted-device whitelisting, Android and iPhone transfer rules, tethering restrictions, CD/DVD controls, password-protected settings, and activity records into one Windows interface. It is the practical choice when unknown storage must be blocked but approved media and normal USB peripherals still have a job to do.

GiliSoft USB Lock

Download the trial and test an unknown drive, an approved drive, required peripherals, and every related transfer channel covered by your policy.

Download Trial View Product

Need deployment support?

GiliSoft offers volume licensing, OEM options, and custom development for organizations with specific device-control or rollout requirements.

Contact sales@gilisoft.com

Verify the USB Storage Restriction

An unknown drive cannot perform the prohibited read or write action.
An approved drive still works when a trusted-device list is used.
Keyboard, mouse, printer, scanner, and security key behavior is unchanged.
The rule still applies after reconnecting the drive and restarting Windows.
Phone transfer, tethering, SD card, and CD/DVD rules are tested separately.
A normal user cannot change password-protected settings.
Allowed and blocked attempts appear in the access log.
The whitelist, recovery details, and exception record are backed up.

Related USB Storage Control Guides

Disable USB Storage Access FAQ

Can I disable USB storage without disabling keyboards and mice?

Yes. Apply removable-storage controls instead of disabling the USB host controller, then test every required peripheral.

What is the difference between deny read, deny write, and deny all?

Deny read prevents users opening or importing files from removable storage. Deny write prevents copying files from the PC to the drive. Deny all blocks both directions.

Can approved USB drives still work when unknown storage is blocked?

Yes. Add verified company drives to the trusted-device whitelist while unknown removable storage remains restricted.

Can USB storage and phone transfer be controlled separately?

Yes. USB Lock provides separate controls for USB and SD storage, Android and iPhone data access, USB tethering, and CD/DVD media.

Is Group Policy available on every Windows edition?

The Local Group Policy Editor is normally available on Pro, Enterprise, and Education editions, not Windows Home. Managed organizations may also use MDM or Microsoft Defender Device Control where licensed.

Why can a blocked USB drive still appear in File Explorer?

Some policies deny reading or writing without removing the drive letter. The device may remain visible, but the restricted operation should fail. Test the exact action rather than checking visibility alone.

Official Windows References

Disable USB storage without disabling everyday peripherals

Test an unknown drive, an approved drive, both copy directions, and every USB peripheral the Windows PC still needs.

Download USB Lock Trial View USB Lock