Prevent Installing Removable Devices Windows

To prevent installing removable devices in Windows, you use Group Policy or the Registry to block installation of specific device classes, such as USB storage drives. This article explains the exact steps for both methods, how to allow specific devices while blocking others, and what to do when the policy doesn’t take effect.

Why Block Removable Device Installation?

Organizations and individuals block removable device installation primarily to prevent data theft, malware introduction, and unauthorized software installation. USB drives, external hard disks, and SD cards can carry viruses or be used to copy sensitive files. Windows provides built-in controls to restrict these devices without disabling the USB ports entirely, which would also stop mice, keyboards, and other essential peripherals.

The most common approach is to block the entire device class for storage devices. This is different from disabling a specific port or drive letter. When you block a device class, Windows will not install drivers for any device that identifies itself as belonging to that class, even if the hardware is physically connected.

How Windows Device Installation Works

When you plug in a removable device, Windows checks the device’s hardware ID and compatible IDs against its driver store and Windows Update. If a matching driver is found, the device is installed and assigned a drive letter (for storage). The installation process is controlled by the Plug and Play (PnP) manager, which can be configured to deny installation for specific device classes.

Device classes are identified by GUIDs (Globally Unique Identifiers). For example, the class GUID for USB storage devices is {36fc9e60-c465-11cf-8056-444553540000}. The class GUID for all USB devices is {36fc9e60-c465-11cf-8056-444553540000} (same as storage? No, that’s only storage). Actually, the USB hub class is different. The policy works by specifying a class GUID and a policy setting that says “Do not install devices with these class GUIDs.”

Method 1: Group Policy (Professional and Enterprise Editions)

Group Policy is the standard tool for managing multiple computers. It is available in Windows 10/11 Pro, Enterprise, and Education editions. Home editions do not have gpedit.msc, so you would use the Registry method instead.

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions.
3. Double-click Prevent installation of devices that match any of these device IDs.
4. Select Enabled, then click Show… under the options.
5. Add the class GUID for the devices you want to block. For USB storage, add: USB\STOR (this is a common device ID pattern, not a class GUID). Actually, the policy uses device IDs, not class GUIDs. To block by class, use the Prevent installation of devices using drivers that match these device setup classes policy.

The correct policy for blocking by class is Prevent installation of devices using drivers that match these device setup classes. Enable it, click Show…, and add the class GUID for the device class you want to block. For example, for USB storage devices, the class GUID is {36fc9e60-c465-11cf-8056-444553540000}.

Method 2: Registry (All Editions)

If you have Windows Home or you prefer a scriptable method, you can edit the Registry. This is the same underlying mechanism that Group Policy uses.

1. Press Win + R, type regedit, and press Enter.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions.
3. Create a new DWORD (32-bit) value named DenyDeviceClasses and set it to 1.
4. Create a new multi-string value named DenyDeviceClassesRetroactive and set it to 1 (this applies the policy to already-installed devices).
5. Under the same key, create a new multi-string value named DenyDeviceClassesList and add the class GUIDs you want to block, one per line.
6. Restart the computer or run gpupdate /force in Command Prompt.

Note: The Registry path is case-sensitive. Also, you must create the Restrictions key if it does not exist.

Allowing Specific Devices While Blocking Others

Sometimes you want to block all USB storage but allow a specific USB drive (e.g., a company-issued encryption key). You can do this by adding an “allow” rule that takes precedence over the deny rule.

In Group Policy, there are two policies: Prevent installation of devices that match any of these device IDs (deny) and Allow installation of devices that match any of these device IDs (allow). The allow policy takes precedence, but only if you also enable the policy Display a warning message when installation of a device is attempted? No, that’s not the precedence rule. Actually, the allow policy overrides the deny policy by default. To use it, add the specific hardware ID of the allowed device to the allow list. You can find the hardware ID in Device Manager under the device’s Details tab.

For example, if you want to allow a specific USB drive, get its hardware ID (e.g., USBSTOR\DISK&VEN_SANDISK&PROD_ULTRA&REV_1.00) and add it to the allow list. Then add the class GUID to the deny list. The allow rule will take precedence for that specific device.

Common Problems and Troubleshooting

The most common issue is that the policy does not take effect immediately. The registry changes require a restart or a gpupdate /force command. Also, if you are using the Registry method, make sure you have created the values with the correct types (DWORD for numbers, multi-string for lists).

Another issue is that the policy blocks all USB devices, not just storage. This happens if you mistakenly add the USB class GUID instead of the storage class GUID. The USB class GUID is {36fc9e60-c465-11cf-8056-444553540000}? No, that is the storage class. The USB device class is {36fc9e60-c465-11cf-8056-444553540000}? Actually, the USB hub class is {36fc9e60-c465-11cf-8056-444553540000}? No. To avoid this, only add the storage class GUID. If you are unsure, test with a USB mouse; if the mouse stops working, you have blocked the wrong class.

If the policy still does not work, check if the device is already installed. The DenyDeviceClassesRetroactive value (or the Group Policy option “Also apply to devices that are already installed”) must be set to 1 to block devices that were installed before the policy was applied.

Comparison: Group Policy vs. Registry vs. Third-Party Tools

Group Policy is the easiest to manage for multiple computers, but it is not available on Home editions. The Registry method works on all editions but is more error-prone. Third-party tools (like USB block software) offer more features such as logging and alerts, but they are not built into Windows and may require a license.

For a single computer, the Registry method is sufficient. For a domain environment, Group Policy is the standard. For a small business without a domain, you can use the Registry method with a script pushed via PowerShell.

Safety and Limitations

Blocking removable devices is a security measure, but it is not foolproof. A determined user could still boot from a USB drive if the BIOS allows it, or use a device that does not identify itself as a storage class (e.g., a keyboard with built-in storage). Also, the policy does not block Bluetooth or network shares.

Always test the policy on a non-critical machine first. If you block the wrong class, you may lose access to your mouse or keyboard. Keep a backup of the registry before making changes.

Frequently Asked Questions

Will this block my USB mouse and keyboard?

No, if you only block the storage class GUID. Mice and keyboards use the HID (Human Interface Device) class, which has a different GUID. However, if you accidentally block the USB hub class, you will lose all USB devices.

Can I block only write access to USB drives?

Yes, you can set the registry value WriteProtect under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies to 1. This makes all USB storage read-only. This is separate from blocking installation.

Does this policy apply to SD cards and external hard drives?

Yes, if they use the same storage class GUID. Most external drives and SD card readers present themselves as storage devices, so they will be blocked.

How do I unblock a device after applying the policy?

Set the deny values to 0 or delete the policy keys, then restart. For Group Policy, set the policy to “Not Configured” and run gpupdate /force.

Will this prevent autorun from executing malware?

No, this only prevents the device driver from installing. Autorun is a separate feature controlled by the AutoPlay settings. You should also disable AutoPlay via Group Policy or Control Panel.

Can I allow a specific USB drive while blocking all others?

Yes, as described above, add the specific hardware ID to the allow list and the class GUID to the deny list. The allow rule takes precedence.

Related

• Ways to get user id in linux
• Lock Messages on iPhone (iOS 18): Step-by-Step
• WhatsApp Backup Full on Android: Clear It