How to Restrict USB and Removable Storage Devices using Group Policy in Active Directory

This lab documents a real-world Group Policy implementation used to restrict USB drives, external hard drives, and all removable storage devices across domain-joined systems in an Active Directory environment.

The configuration addresses a critical security risk in modern on-premises and hybrid environments by preventing unauthorized data transfers, blocking removable media access, and securing Remote Desktop sessions.

Lab Objective

To centrally enforce removable media restrictions using Group Policy, ensuring:

• No read/write access to USB storage

• All removable storage classes are blocked

• USB passthrough is disabled in RDP sessions

• Policies apply consistently across all domain-joined systems

Lab Prerequisites

Before starting this lab, ensure the following:

• A functioning Active Directory domain

• Domain-joined client computers

• Group Policy Management Console (GPMC) installed

• Administrative privileges in the domain

• Target computers placed in the correct OU

Step-by-Step Lab Tasks

 

Step 1: Open Group Policy Management

• Log in to the Domain Controller

• Open Group Policy Management

• Identify the OU containing target computers

Step 2: Create and Link a New GPO

• Create a new Group Policy Object (e.g., Disable USB & Removable Media)

• Link the GPO to the appropriate computer-based OU

💡 These settings apply under Computer Configuration, so the GPO must target computer objects, not users.

Step 3: Edit the Group Policy Object

Navigate to:

Computer Configuration → Administrative Templates → System → Removable Storage Access

Step 4: Configure Removable Storage Policies

Navigate to Computer Configuration → Administrative Templates → System → Removable Storage Access

Enable/Disable the options shown on the right side as per the company requirements.

Enabled Settings (Full Removable Media Restriction)

Removable Disks: Deny read access – Enabled

• Prevents users from opening or viewing files on USB storage

• Blocks access even if the device is physically connected

Removable Disks: Deny write access – Enabled

• Prevents copying or saving files to USB drives

• Reduces data leakage and unauthorized file transfers

All Removable Storage Classes: Deny all access – Enabled

• Blocks all removable storage types, including:

  • USB flash drives

  • External hard drives

  • CDs/DVDs

  • Tape drives

  • Smartphones and portable devices (WPD)

This setting overrides individual device permissions and enforces a blanket restriction.

Disabled Setting (USB Passthrough via RDP)

All Removable Storage: Allow direct access in remote sessions – Disabled

• Prevents USB devices from being redirected into Remote Desktop sessions

• Secures remote access scenarios and hybrid work environments

Not Configured Settings (Left at Default)

The following remain Not Configured:

• CD/DVD (deny read/write/execute)

• Floppy drives

• Tape drives

• Custom device classes

• WPD devices (phones, tablets)

Because “Deny all access to all removable storage classes” is enabled, these device types are already blocked.
Granular configuration is only required if exceptions are needed later.

Step 5: Apply and Enforce the Policy

On target client machines, run:

gpupdate /force

Then:

• Reboot if required

• Test USB access using a standard user account

• Confirm removable media is blocked locally and via RDP

 

 

Lab Outcome

After completing this lab:

• USB and removable storage access is fully restricted

• USB passthrough is blocked in Remote Desktop sessions

• Policy enforcement is centralized and consistent

• Endpoint security posture is significantly improved

This configuration reflects real enterprise security controls used in regulated and hybrid environments.

Why This Matters (Real-World Context)

Removable media remains a common attack vector for:

• Data exfiltration

• Malware introduction

• Policy and compliance violations

Microsoft provides native Group Policy settings to control removable storage access, making this approach fully supported, auditable, and enterprise-ready.