Group Policy to Deny Write Access to USB Devices

Keslaa · 19 Jun 2012

Hello. I am looking for a way to prevent writing to all removable devices. I have found the setting in group policy and enabled it. However, admin credentials are requested and if entered correctly, the user can write to the external drive. I want to configure this to allow writing to a removable device ONLY if the user is in the correct security group or a member of the domain administrators. In other words, this policy would apply to all users and be denied to the security group. Thanks for your time.

Almost forgot: We are still in a 2003 domain, although most of our DCs are now Windows 2008 R2. This policy would apply only to users logging in to our Windows 7 machines.

Ztruker · 19 Jun 2012

From Disable-Enable USB sticks and limit access to USB storage devices « 7explications's Blog

Block USB in Windows 7 using Group Policy
Computer Configuration > Administrative Templates > System > Removable Storage Access
Removable Disks: Deny execute access Enabled
Removable Disks: Deny read access Enabled
Removable Disks: Deny write access Enabled

Keslaa · 20 Jun 2012

Thank you for the response. I set up your recommendations and they worked. Previously, I was applying these settings under the User Configuration group policy.

What I was directed to do, however, was to find a way to block writing only to the removable disk. If I change the above settings and only enable Deny write access, the user can still enter admin credentials to bypass this restriction. Is it possible to completely block writing only with no admin-level bypass?

Ztruker · 20 Jun 2012

Not that I've been able to find. Maybe someone else has some ideas?

logicearth · 20 Jun 2012

Do your users actually have administrator credentials? (i.e., can enter the administrators password?)

doubled822 · 21 Jun 2012

I have this set up on our Windows 2008 R2 functional level domain at work, under computer configuration just as Ztruker directed. The only way our users, admins or not, can access a removable device is if their PC is added to the exception list that we have as a separate GPO nested under the primary one that disables removable devices.

When you say they can access them by using admin credentials, 1. are the users in fact admins? 2. How is this prompted? Do they get a UAC prompt when plugging the device in?