Registry Disable USB
How to Disable Saving to USB in
Registry
The scenario: You want to prevent
users saving files to a USB drive,
probably for security, and to prevent
data theft. After this registry tweak users can still read from the USB
drive.
Topics for Disable USB in Registry
Instructions To Disable USB in the Registry
Key Learning Points to Disable Writing to the USB
Disable Writing to USB Using a .Reg File
Disabling the USB Through Group Policy
Disable USB Windows 8 Group Policy
Preliminary Step
Before you use the registry to disable USB
settings, launch explorer and make sure you can
save files; check that 'New' on the shortcut menu
has not been already disabled by a Group Policy.
Instructions To Disable USB in the Registry
Our mission is to find a specific Control setting in the registry, create
a new Key and then add a DWORD value called WriteProtect.
1) Launch Regedit
2) Navigate to this key:
HKLM\System\ControlSet001\Control
3) Create a New Key called StorageDevicePolices. Ignore the existing
key called plain 'Storage'.
4) Create a New: 'DWORD (32-Bit) Value'. Name this new value:
WriteProtect
5) Edit the 'Value data'. What I do is double click WriteProtect, then
click in the 'Value data:' set to 1. If it displays as 0x00000001 (1)
this is a good sign it is going to disable saving to the USB drive.
6) To check the fruits of your labours, close the registry editor and
restart the computer.
Screenshot showing how the registry can disable USB with
WriteProtect = 1.
To Use the Registry to Enable USB Settings
It's easy to employ the registry to enable USB settings. Launch
regedit and use 'Find' to get to StorageDevicePolices. There, seek the
setting WriteProtect and set its Data = 0 (zero). This means reverse
the protection.
Key Learning Points to Disable Writing to the USB
The overall learning point is that WriteProtect requires a new
parent folder or Key called StorageDevicePolices (see above
screenshot).
Do you find the WriteProtect value in HKCU** or HKLM?
Answer: HKLM.
Do you have to add a value, or modify an existing setting?
Answer: Add a new key then a new value.
Is it a String Value or a DWORD?
Answer: DWORD (32-Bit Value)
Do you need to Restart, or merely Logoff / Logon?
Answer: Restart
Tip: Add this Value, WriteProtect to Regedit's Favorites menu
** HKLM is an abbreviation of HKEY_LOCAL_MACHINE, and HKCU is
shorthand for HKEY_CURRENT_USER. These acronyms are so well-
known that you can even use them in .reg files, Windows 7will
understand and obey the registry instruction.
Disable Writing to USB Using a .Reg File
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Stor
ageDevicePolicies]
"WriteProtect"=dword:00000001
Note: There is an extra line after Windows Registry Editor Version
5.00
How to Import .Reg Files Into the Registry
The concept is simple; create a text file with notepad, then type, or
copy and paste the above 4 lines. Crucially, save the file not as a
.txt, but with a .reg extension.
Once you have the information about the key, the settings and the
value in that file, there are at least three ways of importing the
information into your registry.
1. Double-click the .reg file.
2. Right-click the .reg file, select Merge from the drop-down menu.
3. Launch Regedit then select, File (menu) Import.
See more examples of .reg files
Disabling the USB Through Group Policy
As far as I can see, Group Policy does not have a default setting to
disable drives containing removable media, such as USB ports, CD-
ROM drives. However you can apply ADM templates which extend
Group Policy to use customised settings.
Here is an ADM for Windows Server 2003:
CLASS MACHINE
CATEGORY !!category
CATEGORY !!categoryname
POLICY !!policynameusb
KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR"
EXPLAIN !!explaintextusb
PART !!labeltextusb DROPDOWNLIST REQUIRED
VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamecd
KEYNAME "SYSTEM\CurrentControlSet\Services\Cdrom"
EXPLAIN !!explaintextcd
PART !!labeltextcd DROPDOWNLIST REQUIRED
VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 1 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynameflpy
KEYNAME "SYSTEM\CurrentControlSet\Services\Flpydisk"
EXPLAIN !!explaintextflpy
PART !!labeltextflpy DROPDOWNLIST REQUIRED
VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
POLICY !!policynamels120
KEYNAME "SYSTEM\CurrentControlSet\Services\Sfloppy"
EXPLAIN !!explaintextls120
PART !!labeltextls120 DROPDOWNLIST REQUIRED
VALUENAME "Start"
ITEMLIST
NAME !!Disabled VALUE NUMERIC 3 DEFAULT
NAME !!Enabled VALUE NUMERIC 4
END ITEMLIST
END PART
END POLICY
END CATEGORY
END CATEGORY
[strings]
category="Custom Policy Settings"
categoryname="Restrict Drives"
policynameusb="Disable USB"
policynamecd="Disable CD-ROM"
policynameflpy="Disable Floppy"
policynamels120="Disable High Capacity Floppy"
explaintextusb="Disables the computers USB ports by disabling
the usbstor.sys driver"
explaintextcd="Disables the computers CD-ROM Drive by
disabling the cdrom.sys driver"
explaintextflpy="Disables the computers Floppy Drive by
disabling the flpydisk.sys driver"
explaintextls120="Disables the computers High Capacity Floppy
Drive by disabling the sfloppy.sys driver"
labeltextusb="Disable USB Ports"
labeltextcd="Disable CD-ROM Drive"
labeltextflpy="Disable Floppy Drive"
labeltextls120="Disable High Capacity Floppy Drive"
Enabled="Enabled"
Disabled="Disabled"
Summary of How to Disable USB in the Registry
This is a job for Regedit. Firstly you research the correct hive of
HKLM. Then create the key StorageDevicePolices. Next add a
DWORD called WriteProtect. A value of 1 means disable USB in the
registry.