Windows 11/10 USB Storage Guide

How to Block USB Storage Devices on Windows

Stop flash drives, external USB disks, SD card storage, and phone data-transfer channels without disabling the keyboards and mice people still need.

Block USB storageKeep keyboard and mouse workingAllow trusted drives
Download USB LockView USB Lock
GiliSoft USB Lock controls for USB disks, phone storage, SD cards, and trusted devices

Choose the storage channels to restrict while leaving ordinary USB peripherals available.

Block Storage Access, Not Every USB Peripheral

USB storage control should focus on removable data channels. Disabling every USB controller can also interrupt keyboards, mice, webcams, printers, and other devices that are unrelated to file copying.

Quick answerFor the clearest Windows workflow, open USB & CD Lock in GiliSoft USB Lock and disable USB disk reading, writing, or both. Add approved company drives to the trusted-device whitelist when selected storage still needs access.
Block readingStop users from opening or copying files from removable USB storage.
Block writingStop files from being copied from the PC to flash drives and external USB disks.
Allow approved drivesKeep reviewed company USB devices usable through trusted-device rules.

Choose the Right Blocking Level

Your goalRecommended controlWhat remains available
Prevent data from leaving the PCDisable writing to USB disksUSB storage may remain readable, depending on policy.
Prevent any USB storage useDisable reading and writingKeyboard, mouse, and unrelated peripherals can remain available.
Block personal drives but allow company drivesDefault restriction plus trusted-device whitelistOnly approved USB storage remains usable.
Temporarily stop a storage driverWindows Group Policy or RegistryBehavior depends on the selected Windows rule and edition.
Recommended for direct control
1

Block USB Storage with GiliSoft USB Lock

Use a visible policy screen instead of editing device identifiers or registry values by hand.

  1. Install and open GiliSoft USB Lock, then enter the administrator password.
  2. Open USB & CD Lock from the Control Center.
  3. Select Disable Reading USB Disk, Disable Writing to USB Disk, or both, according to the required policy.
  4. Apply the policy, reconnect a test flash drive, and verify the expected read and write behavior.
USB & CD Lock separates storage controls from broader device controls. Click the screenshot to enlarge it.
Do not select more channels than the policy requires. If the concern is copying files to removable media, disabling USB writing may be enough. Add phone transfer, SD card, or tethering restrictions only when those channels also need control.

Allow Trusted USB Drives While Unknown Storage Stays Blocked

A blanket ban is not practical when staff still use approved encrypted drives, service media, or company-issued storage. In that case, keep the restriction active and add reviewed devices to the trusted-device whitelist.

  1. Connect one approved company USB drive.
  2. Click Add in the Trusted Devices White-list area.
  3. Repeat for each approved drive, then test an unknown drive.
  4. Use Export and Import when the same list is needed on other PCs.
Approved USB devices can be recorded once and reused as a controlled list on other managed Windows PCs.

For the full deployment workflow, see How to Whitelist USB Devices on Windows.

Windows Pro and Enterprise
2

Block Removable Storage with Group Policy

This method suits administrators already managing Windows policies and does not require third-party software.

  1. Press Windows + R, enter gpedit.msc, and open the Local Group Policy Editor.
  2. Go to the Removable Storage Access policy location shown below.
  3. Open All Removable Storage classes: Deny all access.
  4. Set the policy to Enabled, apply it, and restart or refresh policy before testing.
Computer Configuration > Administrative Templates > System > Removable Storage Access
Windows edition matters: Local Group Policy Editor is generally available in Pro, Enterprise, and Education editions, not standard Windows Home installations. Domain or Intune environments should test policy scope before broad deployment.
Manual Windows method
3

Disable the USB Storage Driver in the Registry

This is a coarse local setting for USB mass-storage support. Back up the registry and record the restore value before changing it.

  1. Press Windows + R, enter regedit, and approve the administrator prompt.
  2. Open the USBSTOR service key shown below.
  3. Open the Start DWORD and set it to 4 to disable the USB storage service.
  4. Restart Windows and test a USB storage device. To restore the service, change the value back to 3.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR
Use this method carefully. It does not provide the clear per-device whitelist, separate read/write choices, or activity review available in dedicated USB control software.
Temporary troubleshooting only
4

Why Disabling USB Controllers Is Usually the Wrong Method

Device Manager can disable USB controllers or hubs, but that approach can affect far more than storage.

What may stop working

USB keyboards, mice, webcams, printers, audio devices, docking hardware, and other peripherals connected through the disabled controller.

When it may be useful

Short troubleshooting sessions on a machine with an alternative input method and a documented recovery plan.

Compare the Four Methods

MethodSeparate read/write rulesTrusted-device listBest fit
GiliSoft USB LockYesYesOffice, school, shared, and managed Windows PCs
Group PolicyPolicy dependentAdvanced configurationPro/Enterprise environments with policy administration
Registry USBSTORNoNoCoarse local blocking and experienced administrators
Disable USB controllerNoNoTemporary troubleshooting, not normal storage policy

Verify the USB Storage Policy

Test reading

Open a file on an unapproved USB drive and confirm the configured read restriction.

Test writing

Copy a harmless test file to the USB drive and confirm the configured write restriction.

Test trusted devices

Connect an approved drive and confirm it receives only the intended permissions.

Review USB activity after testing so administrators can confirm when access was allowed or denied.

USB Storage Blocking FAQ

Can I block USB storage without disabling my keyboard and mouse?

Yes. Use storage-specific read/write controls instead of disabling USB controllers or hubs.

Can I block copying files to USB but still read the drive?

Yes. A write restriction targets copy-out activity while read access can remain available.

Can approved company USB drives remain usable?

Yes. Add reviewed drives to the trusted-device whitelist and test both approved and unknown devices.

Does USB storage blocking encrypt the files on a drive?

No. Blocking controls access on the PC. Use USB Encryption when files on the drive itself need password protection.

Block unknown USB storage while approved work continues

Control USB disk reading and writing, keep trusted devices available, and review access activity from one Windows application.

Buy GiliSoft USB Lock