Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Group Policy to Deny Write Access to USB Devices

19 Jun 2012   #1

Windows 7 Enterprise 64-bit
Group Policy to Deny Write Access to USB Devices

Hello. I am looking for a way to prevent writing to all removable devices. I have found the setting in group policy and enabled it. However, admin credentials are requested and if entered correctly, the user can write to the external drive. I want to configure this to allow writing to a removable device ONLY if the user is in the correct security group or a member of the domain administrators. In other words, this policy would apply to all users and be denied to the security group. Thanks for your time.

Almost forgot: We are still in a 2003 domain, although most of our DCs are now Windows 2008 R2. This policy would apply only to users logging in to our Windows 7 machines.

My System SpecsSystem Spec
19 Jun 2012   #2

Windows 8 Core X64

From Disable-Enable USB sticks and limit access to USB storage devices 7explications's Blog

Block USB in Windows 7 using Group Policy
Computer Configuration > Administrative Templates > System > Removable Storage Access
Removable Disks: Deny execute access Enabled
Removable Disks: Deny read access Enabled
Removable Disks: Deny write access Enabled
My System SpecsSystem Spec
20 Jun 2012   #3

Windows 7 Enterprise 64-bit

Thank you for the response. I set up your recommendations and they worked. Previously, I was applying these settings under the User Configuration group policy.

What I was directed to do, however, was to find a way to block writing only to the removable disk. If I change the above settings and only enable Deny write access, the user can still enter admin credentials to bypass this restriction. Is it possible to completely block writing only with no admin-level bypass?
My System SpecsSystem Spec
20 Jun 2012   #4

Windows 8 Core X64

Not that I've been able to find. Maybe someone else has some ideas?
My System SpecsSystem Spec
20 Jun 2012   #5

Windows 8.1 Pro (x64)

Do your users actually have administrator credentials? (i.e., can enter the administrators password?)
My System SpecsSystem Spec
21 Jun 2012   #6

Windows 7 Ultimate x64, BackTrack Linux 5 R2, Windows XP

I have this set up on our Windows 2008 R2 functional level domain at work, under computer configuration just as Ztruker directed. The only way our users, admins or not, can access a removable device is if their PC is added to the exception list that we have as a separate GPO nested under the primary one that disables removable devices.

When you say they can access them by using admin credentials, 1. are the users in fact admins? 2. How is this prompted? Do they get a UAC prompt when plugging the device in?
My System SpecsSystem Spec

 Group Policy to Deny Write Access to USB Devices

Thread Tools

Similar help and support threads for2: Group Policy to Deny Write Access to USB Devices
Thread Forum
Group Policy - Apply to a Specific User or Group Tutorials
The Group Policy failed the logon. Access Denied General Discussion
usb deny write access problem General Discussion
How to use Local Group policy to prevent access to User Account settin Customization
How do I limit access to the Local Group Policy Editor? System Security
Can't access Local Group Policy Editor General Discussion
Group Policy Editor or Local Security Policy System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 07:55 PM.
Twitter Facebook Google+

Windows 7 Forums

Seven Forums Android App Seven Forums IOS App