In most companies anyone can plug a flash drive or external hard drive into their computer and copy any file. That convenience brings two serious risks: the silent removal of important data such as customer lists, pricing and financial documents, and malware coming in from a home computer or an infected outside system. The good news is that controlling USB does not require buying expensive tools; much of the work can be done with built-in Windows features and Group Policy.
Policy First, Then Tools
Before any technical setting, decide with department heads who really needs removable storage. Usually three groups emerge:
- Most employees: They do not need USB storage, and their access is blocked.
- Some departments, such as design or purchasing: Read-only access, or write access only to encrypted drives.
- A small number of approved people: Full access, and only with drives issued by the company.
Put this decision in writing and communicate it to staff. Technical controls without a clear policy only lead to repeated requests and arbitrary exceptions.
Blocking with Group Policy
On a network with Active Directory, the main settings are at this path:
Computer Configuration > Administrative Templates > System > Removable Storage Access
A few commonly used settings in this section:
- All Removable Storage classes: Deny all access to completely block all removable storage.
- Removable Disks: Deny write access when only reading is allowed.
- WPD Devices: Deny read access and Deny write access for phones and devices that connect as portable devices (for example over MTP) and are not recognized as flash drives.
- Separate settings for CDs and DVDs, if you still have optical drives.
Most of these settings also exist under User Configuration. Apply the policy to the relevant OU and create a separate GPO for permitted groups.
Block only the “storage” class, not USB as a whole. If you block all USB devices, keyboards, mice, scanners or the accounting software’s hardware license dongle may stop working too.
Exceptions for Approved Drives
For people who need to work with removable storage, it is best for the company to purchase and register a few specific drives. With the Device Installation Restrictions settings, you can restrict device installation by hardware ID and allow only those drives. The details and evaluation order of these rules differ slightly between Windows versions, so test on a few computers before rolling out widely. In some EDR products, device control is easier to manage through a central console with reporting; the exact features depend on the product and license.
Encryption: If a Drive Gets Lost
Even an approved drive can be left behind in a cab. BitLocker To Go encrypts removable storage so it cannot be read without the password. In Group Policy, the Deny write access to removable drives not protected by BitLocker setting lets you block writing to any drive that is not encrypted. That way, even authorized users can only take data out on encrypted drives.
Stop Malware Too
- Turn off AutoPlay and AutoRun for all drives with a GPO.
- Configure antivirus or EDR to scan removable storage when it is connected.
- Disable booting from USB in the computers’ BIOS or UEFI and set a password for its settings.
- Set aside a separate computer outside the domain for checking files brought in by guests or contractors.
Common Mistakes
- Blocking USB while leaving other routes open, such as personal email, cloud storage and messaging apps; data does not leak through just one door.
- Giving users Local Admin rights, which lets them bypass the settings.
- Temporary exceptions that are never removed once the need has passed.
- Applying the policy to every computer without testing and without informing staff.
Checklist
- The removable storage policy is written down and announced.
- Removable storage is blocked for regular users with a GPO.
- Phones (WPD) and optical drives are also covered.
- Writing is only allowed to drives encrypted with BitLocker.
- AutoPlay is off and booting from USB is disabled.
- The list of exceptions is reviewed every few months.
USB control is one of the simplest steps for protecting company data. ITPlus724 engineers can define the right policy with you and apply it across your network without disrupting daily work.