How can I prevent users from writing to USB removable disks (USB flash drives) by using Group Policy (GPO)?
USB removable disks (also known as flash drives or “Disk on Key” and other variations) are quickly becoming an integral part of our electronic life, and now nearly everybody owns one device or another, in forms of small disks, external hard drives that come enclosed in cases, card readers, cameras, mobile phones, portable media players and more.
Portable USB flash drives are indeed very handy, but they can also be used to upload malicious code to your computer (either deliberately or by accident), or to copy confidential information from your computer and take it away.
Microsoft has introduced some changes into Windows XP Service Pack 2 that allow an administrator some control over how USB Removable Disks (or flash drives) are handled. A new storage device policy named WriteProtect makes it possible to prevent all removable USB drives from being written to. Users can still read from these devices, but are not longer able to write to them.
This tip is a variation of Disable Writing to USB Disks in XP SP2, you can prevent users from writing on to any portable USB removable disk or flash drive by using a custom .ADM file that can be imported into the Local Group Policy (thus effecting only the local computer) or by using Active Directory-based Group Policy Objects (also known as GPOs).
Follow the steps outlined in the Adding New Administrative Templates to a GPO article on general instructions on how to add or remove an .ADM file from the Administrative Templates section in GPO.
It’s worth mentioning that in Windows Vista Microsoft has implemented a much more sophisticated method of controlling USB disks via GPO. If you have Windows Vista client computers in your organization you can use GPO settings edited from one of the Vista machines to control if users will be able to install and use USB disks, plus the ability to control exactly what device can or cannot be used on their machines.
Needless to say, as with any GPO setting, this option will only work on Windows 2000 operating systems or higher.
After downloading the .ADM file, read Adding New Administrative Templates to a GPO.
You might also be interested in reading Disable USB Disks with GPO.
Note: In order to successfully view and configure the new .ADM file settings you will need to change the default filtering view for the GPO Editor (or GPedit.msc). Unless you change these settings, the right pane will appear empty, even though it has the settings in it.
Users trying to write to any USB Removable Disk will now get an Access Denied message.
Follow these steps:
- In GPEdit.msc (or any other GPO Editor window you’re using) click on View > Filtering.
- Click to un-select the “Only show policy settings that can be fully managed” check-box. Click Ok.
- Now you will be able to see the new settings in the right pane:
- You can now change the available settings:
You may find these related articles of interest to you:
- Adding New Administrative Templates to a GPO
- Controlling IE cache size via GPO
- Disable USB Disks
- Disable USB Disks with GPO
- Disable Writing to USB Disks in XP SP2
- Download GPMC
- Download Group Policy ADM Files for All Microsoft Operating Systems
- Download Group Policy Settings Reference
- Download Office 2000 Reskit Tools
- Download Office System 2003 Reskit Tools
- Download Office System 2003 SP2 ADMs and Explain Text Update
- Download Office XP Reskit Tools
- Event logs archiving with GPO
- Understanding Administrative Templates in GPO