Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Group Policy to Deny Write Access to USB Devices

19 Jun 2012   #1

Windows 7 Enterprise 64-bit
Group Policy to Deny Write Access to USB Devices

Hello. I am looking for a way to prevent writing to all removable devices. I have found the setting in group policy and enabled it. However, admin credentials are requested and if entered correctly, the user can write to the external drive. I want to configure this to allow writing to a removable device ONLY if the user is in the correct security group or a member of the domain administrators. In other words, this policy would apply to all users and be denied to the security group. Thanks for your time.

Almost forgot: We are still in a 2003 domain, although most of our DCs are now Windows 2008 R2. This policy would apply only to users logging in to our Windows 7 machines.

My System SpecsSystem Spec
19 Jun 2012   #2

Windows 10 Pro X64

From Disable-Enable USB sticks and limit access to USB storage devices 7explications's Blog

Block USB in Windows 7 using Group Policy
Computer Configuration > Administrative Templates > System > Removable Storage Access
Removable Disks: Deny execute access Enabled
Removable Disks: Deny read access Enabled
Removable Disks: Deny write access Enabled
My System SpecsSystem Spec
20 Jun 2012   #3

Windows 7 Enterprise 64-bit

Thank you for the response. I set up your recommendations and they worked. Previously, I was applying these settings under the User Configuration group policy.

What I was directed to do, however, was to find a way to block writing only to the removable disk. If I change the above settings and only enable Deny write access, the user can still enter admin credentials to bypass this restriction. Is it possible to completely block writing only with no admin-level bypass?
My System SpecsSystem Spec

20 Jun 2012   #4

Windows 10 Pro X64

Not that I've been able to find. Maybe someone else has some ideas?
My System SpecsSystem Spec
20 Jun 2012   #5

Windows 10 Pro (x64)

Do your users actually have administrator credentials? (i.e., can enter the administrators password?)
My System SpecsSystem Spec
21 Jun 2012   #6

Windows 7 Ultimate x64, BackTrack Linux 5 R2, Windows XP

I have this set up on our Windows 2008 R2 functional level domain at work, under computer configuration just as Ztruker directed. The only way our users, admins or not, can access a removable device is if their PC is added to the exception list that we have as a separate GPO nested under the primary one that disables removable devices.

When you say they can access them by using admin credentials, 1. are the users in fact admins? 2. How is this prompted? Do they get a UAC prompt when plugging the device in?
My System SpecsSystem Spec

 Group Policy to Deny Write Access to USB Devices

Thread Tools

Similar help and support threads
Thread Forum
How to Override Group Policy Preventing Access to USB Ports
Hello: Once a month, I backup my laptop's files to an external hard drive. But, about three months ago, my company enabled Group Policy to where none of us employees are able to plug external hard drives into our USB ports. Is there a way of overriding this policy? If not, is there a way...
Hardware & Devices
The Group Policy failed the logon. Access Denied
One of my user accounts have been getting the error above after a shutdown. I tried system restore but it did not work. I have tried disabling non-windows service on startup and that didn't work Can someone help me please!!
General Discussion
usb deny write access problem
hello, my first post problem is as follows... I have a win7 peer2peer netwrk with 10 computers To block usb write access i created 3 accounts on each machines superAdmin :(administrator acc) full rights localAdmin : (administrator acc) Removable disk :deny write access policy...
General Discussion
How do I limit access to the Local Group Policy Editor?
I have set some access limits on some programs, but the user that has the limits can run the Local Group Policy Editor and change the settings. How do I prevent access by other users to the Local Group Policy Editor? Thanks for the help.
System Security
Can't access Local Group Policy Editor
I want to disable the default reboot after Windows runs unattended updates as this often prevents my overnight backup from running. I have tried using the gpedit.msc routine to access the Local Computer Policy Editor but apparently that does not work in Win 7 Home Premium which I have. Is...
General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:27.
Twitter Facebook Google+