In my previous article â€œHow to use Group Policy to make USB drives read only on Windows XPâ€ I showed you you could configure Windows XP to prevent users from writing to USB block level devices. However for some organisations just making drives read only is not enough I have heard stories of them having to resort to using hot glue guns to prevent people using USB storage devices.
Update: I just found this article explains how use native Group Policy to disable you USB drives. Microsoft Support: HOWTO: Use Group Policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers
Thankfully there is also a registry key in Windows XP that allows you to block the use of USB storage devices. Now there are two ways to prevent USB storage devices so you may want to implement either or both methods in your organisation. First method prevents computers that have already had USB devices installed and the second prevents any new USB devices from installing.
How to block existing USB Storage Devices
To implement this edit a Group Policy Object that is applied to all the workstations in your organisation navigate to Computer Configuration > Preferences >Windows Settings > Registry. Then click on Action > New > Registry Item type SYSTEM\CurrentControlSet\Services\UsbStor into the Key Path field then type Start into the Value Name field and 4 in the Value Data field and click OK.
If you want to prevent the installation of USB storage device then we use Group Policy to set the security on the driver files to prevent then from installing.
Data: 4 (hex) = Disabled
Data: 3 (hex) = Enabled
How to block new USB Storage Devices
This time edit a Group Policy Object that is applied to all the workstations in your organisation navigate to Computer Configuration > Policies > Windows Settings > Security Settings > File System. Then click on â€œActionâ€ menu and then â€œAdd Fileâ€. Navigate to C:\Windows\Inf and select â€œUsbstor.infâ€ and press â€œOKâ€. Now click on â€œUsersâ€ in the security tab and then click in the â€œDenyâ€ â€œFull Controlâ€ tick box then click OK.
Note: Alternatively you could just add the name of the user or group you want to prevent from using USB storage devices.
Click â€œYesâ€ to the security warning.
Then click OK.
Note: Remember that deny permission take precedence so inherited permission will not have any affect and that we are applying the permission directly to a file so we don’t need to worry about inheritance from this object.
Now repeat the steps above and this time select â€œC:\Windows\Inf\Usbstor.pnfâ€
You should see something like the images below in your group policy.
Now either way when users plug in a USB Storage devices into a computer it will prevent OS from seeing the device thus preventing the users from reading and writing to removable media.
See the Microsoft article about this option at http://support.microsoft.com/kb/823732
HOWTO: Use Group Policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers
24 thoughts on “How to use Group Policy to disable USB drives on Windows XP”
Blog Post: How to use Group Policy to di… https://www.grouppolicy.biz/2010/02/how-to-use-group-policy-to-disable-usb-drives-on-windows-xp/
RT @grouppolicy_biz: Blog Post: How to use Group Policy to di… https://www.grouppolicy.biz/2010/02/how-to-use-group-policy-to-disable-usb-drives-on-windows-xp/
How to use Group Policy to disable USB drives on Windows XP http://is.gd/8vmSd
RT @xenappblog: How to use Group Policy to disable USB drives on Windows XP http://is.gd/8vmSd
i have followed the above step’s as shown in ur blog ,
how can give permission to several other user’s to access the usb like system administrator
thnks in advance
First, thanks again for your all great Articles.
Second, I have one question about Other USB Devices.
How can disable or blocking other USB Devices (USB Modem, Keyboard and etc.) with GPP but under Windows XP as Client and Windows Server 2008 or 2008 R2 as DC.
With GPP setting for Disabling Other USB devices with Windows 7 work fine but not work with XP.
Can you tell me, why?
@Mashti The Device blocking was a new feature that was introduced in Windows Vista…. They have not backported it to Windows XP.
Thanks for your Answer and free Support.
How can blocking or disable other USB device on XP via GPO or GPP or registry?
Is there such a thing (Tips or Trick)?
I want to block usb reading/writing, but i also want to allow users to use usb modem to send data via internet, is there a way to allow only USB MODEM?
Did you see this article https://www.grouppolicy.biz/2010/02/how-to-use-group-policy-to-make-usb-drives-read-only-on-windows-xp/
Otherwise the functionality you are looking for is in Windows Vista and 7…
Will be using netbook in our field survey operations.We have netbooks with Windwos 7 professional, can I prevent regular users from installing or copy files like games from usb to the system using Bitlocker?
Thank you allan
Group Policy Central http://t.co/Swh2zxXX
how can i block facebook and other sites from GPO with making DNS?
Hello everyone…..I have one problem…..can anyone tell me how to block facebook and other sites from windows server 2008 to all clients without making DNS server?
The most effective way to do this is on the permieter via a proxy/firewall… then if you are really desperate you might use this method https://www.grouppolicy.biz/2010/07/how-to-use-group-policy-to-allow-or-block-urls/ but i STRONGLY STRONGLY STRONGLY don’t recommend that way…
I’m not sure all these answers are what I was looking for.
I have 1000+ devices I want to inhibit USB drives on.
Was hoping to do it directly from the DC when they log-on.
Thanks for the efforts so far through, I would just like to tidy this up and not walk around the whole organisatio.
how can i enable other USB devices (mouse & keyboard) and disable the rest
More importantly, is it something that you are passionate about, or can contribute something to.
She has several blogs, including the one at where she posts about publishing online
using blogs, article syndication, video, and more. In order to master a skill you must constantly work
registry not updating for client PC XP
it doesn’t work for usb3 devices, is there a way to disable usb3 storages devices too?