This tutorial will show you how to enable or disable read and write access to all removable storage devices for all or specific users in Windows 10 and Windows 11.
Users are allowed read and write access to removable storage devices (ex: USB, SD Card, CD/DVD) they connect to the computer by default in Windows.
You must be signed in as an administrator to enable or disable read and write access to all removable storage devices.
Contents
- Option One: Enable or Disable Access to Removable Storage Devices for All Users in Local Group Policy Editor
- Option Two: Enable or Disable Access to Removable Storage Devices for Specific Users in Local Group Policy Editor
- Option Three: Enable or Disable Access to Removable Storage Devices for All Users using REG file
EXAMPLE: Access is denied for removable USB drive
Enable or Disable Access to Removable Storage Devices for All Users in Local Group Policy Editor
The Local Group Policy Editor is only available in the Windows 10/11 Pro, Enterprise, and Education editions.
All editions can use Option Three to configure the same policy.
1 Open the Local Group Policy Editor (gpedit.msc).
2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)
Computer Configuration > Administrative Templates > System > Removable Storage Access
3 In the right pane of Removable Storage Access in the Local Group Policy Editor, double click/tap on the All Removable Storage classes: Deny all access policy to edit it. (see screenshot above)
4 Do step 5 (enable) or step 6 (disable) below for what you want.
5 Enable Access to Removable Storage Devices for All Users
This is the default setting.
A) Select (dot) Not Configured, click/tap on OK, and go to step 7. (see screenshot below)
6 Disable Access to Removable Storage Devices for All Users
This will override Option Two.
A) Select (dot) Enabled, click/tap on OK, and go to step 7. (see screenshot below)
7 Close the Local Group Policy Editor.
Enable or Disable Access to Removable Storage Devices for Specific Users in Local Group Policy Editor
The Local Group Policy Editor is only available in the Windows 10/11 Pro, Enterprise, and Education editions.
1 Open the all users, specific users or groups, or all users except administrators Local Group Policy Editor for how you want this policy applied.
2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)
User Configuration > Administrative Templates > System > Removable Storage Access
3 In the right pane of Removable Storage Access in the Local Group Policy Editor, double click/tap on the All Removable Storage classes: Deny all access policy to edit it. (see screenshot above)
4 Do step 5 (enable) or step 6 (disable) below for what you want.
5. Enable Access to Removable Storage Devices
This is the default setting.
A) Select (dot) Not Configured, click/tap on OK, and go to step 7. (see screenshot below)
6. Disable Access to Removable Storage Devices
A) Select (dot) Enabled, click/tap on OK, and go to step 7. (see screenshot below)
7 Close the Local Group Policy Editor.
This option will override Option Two.
1 Do step 2 (enable) or step 3 (disable) below for what you would like to do.
2 Enable Access to Removable Storage Devices for All Users
This is the default setting
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Enable_access_to_all_removable_storage_devices_for_all_users.reg
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\RemovableStorageDevices]
"Deny_All"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices]
"Deny_All"=-3 Disable Access to Removable Storage Devices for All Users
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Disable_access_to_all_removable_storage_devices_for_all_users.reg
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices]
"Deny_All"=dword:000000014 Save the REG file to your desktop.
5 Double click/tap on the downloaded REG file to merge it.
6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
7 Restart the computer to apply.
8 You can now delete the downloaded REG file if you like.
That's it,
Shawn Brink
Attachments
Last edited:
