Unable to disable USB Mass Storage using Windows policies or registry keys

I have a Windows PC which must have USB mass storage disabled. I have gone into Group Policy Editor (Computer Configuration -> Administrative Templates -> System -> Removable Storage Access) and enabled all three removable disk policies which deny R,W,X access. I have enabled the policy to deny all access to all removable storage classes , and disabled direct access in remote sessions to all removable storage. However, after rebooting my machine, my machine was still able to detect any external USBs and read their files (e.g. open .txt files).

I then tried going into the registry to modify the following keys:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\USBSTOR

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR

For both keys, I modified the Start value and set it to 4 to not avail. Then I tried a creating a new subkey for both USBTOR keys (named Parameters), creating a DWORD 32-bit value named DisableRemovableStorage and setting the value to 1.

None of the measures described above have prevented my PC from detecting USB mass storage devices and interacting with the files stored in them. I have thought of removing all permissions to the USBSTOR.SYS driver and USBSTOR.INF file but I am concerned that in doing so, it could eventually break my system. Therefore, is there any policy or key I need to modify to disable USB mass storage?

Hello, and welcome.

That would only disable "new" USB connections like below instead of all.


If wanted, you can use a different "All Removable Storage classes: Deny all access" policy in the tutorial below to deny access to all removable storage devices

Does anything on the computer need access to USB devices? If not, I'd think unplugging them would work. Or is the need for preventing others from plugging in a USB drive?

I have always found that if I do not need to use a particular piece of hardware I would physically disable that device. If it was hardwired to the motherboard, I would find out if the USB ports was able to be disabled on the board by jumper switches or within the BIOS through a parameter.

FFT: IF your USB or other peripherals are connected thtough a ribbon cable sometimes they can be disabled more permanently than with jumpers or a BIOS parameter entry by NOT connecting them to the motherboard.

At least that worked for me...

Cheers!

Brink said:

Hello, and welcome.

That would only disable "new" USB connections like below instead of all.

Add Enable or Disable New "USB connections" Context Menu in Windows 11 Tutorial

This tutorial will show you how to add a "USB connections" desktop context menu that allows you to quickly enable or disable new USB storage device connections on demand in Windows 10 and Windows 11. When disabled, any new USB storage device (ex: USB flash drive or external USB drive) connected...

www.elevenforum.com

If wanted, you can use a different "All Removable Storage classes: Deny all access" policy in the tutorial below to deny access to all removable storage devices

Enable or Disable Access to Removable Storage Devices in Windows 11 Tutorial

This tutorial will show you how to enable or disable read and write access to all removable storage devices for all or specific users in Windows 10 and Windows 11. Users are allowed read and write access to removable storage devices (ex: USB, SD Card, CD/DVD) they connect to the computer by...

www.elevenforum.com

Click to expand...

Thank you @Brink I tried following your tutorial by enabling the Deny All Access policy for both local machine and current configuration but it did not make any changes. I also went to the registry and ensured that for both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER had the RemovableStorageDevices key with the Deny_All value set to 1. Then I rebooted my machine but nothing has changed and USB mass storage are still not being blocked.

Cadena said:

Thank you @Brink I tried following your tutorial by enabling the Deny All Access policy for both local machine and current configuration but it did not make any changes. I also went to the registry and ensured that for both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER had the RemovableStorageDevices key with the Deny_All value set to 1. Then I rebooted my machine but nothing has changed and USB mass storage are still not being blocked.

Click to expand...

Odd. Did you try opening the USB afterwards?

Removable storage devices (ex: USB) will still show up in File Explorer > This PC, but will give a "Access is denied" error message when trying to open it.

I need to disable USB Mass Storage. I want to disable Generic USB Hub and USB Root Hub (USB 3.0) in Device Manager but when I right-click on them, the option to Disable device does not appear. If I go to Properties -> Device for each device, the option Disable Device is greyed out. Please could someone how may I be able to disable USB Hubs from Device Manager?

Brink said:

Odd. Did you try opening the USB afterwards?

Removable storage devices (ex: USB) will still show up in File Explorer > This PC, but will give a "Access is denied" error message when trying to open it.

Click to expand...

Yes I tried and I could open the files in the USB without any restriction whatsoever. I think it should be possible to disable USB mass storage without disabling the ports themselves by disabling USB Hub devices in device manager. I tried this on another computer and it worked perfectly. However, the computer I need to disable removable devices is not allowing me to disable USB Hub. I created a new post since it is not related to the GPO or registry changes I already implemented.

New Post: Cannot disable USB Hub in Device Manager

If you disables those you would break anything USB (mice, keyboards etc). You can just disable storage by following this. Same thing in Windows 10/11 Enable or Disable Access to All Removable Storage Devices in Windows