How to Block USB Devices on Windows

Blocking USB storage stops data walking out on a thumb drive and stops malware walking in. Windows can disable USB mass storage without breaking the keyboard and mouse, or set drives to read-only so files can be read but nothing can be written to them. This guide covers the USBSTOR registry method, the Removable Storage Group Policy, read-only mode, and how to enforce USB control across a fleet.

Block storage, keep input devices

The key to USB control is being specific. You want to block mass storage - the drives people use to copy data - while leaving human-interface devices like keyboards, mice, and security keys working.

Windows treats USB device classes separately, so disabling the USBSTOR driver stops storage devices without touching input devices.

The methods

There are three common approaches, from simplest to most precise.

  • USBSTOR driver - set its Start value to 4 to disable USB mass storage, 3 to re-enable
  • Removable Storage Access policy - 'All Removable Storage classes: Deny all access' via Group Policy
  • Read-only mode - a WriteProtect policy that allows reads but blocks writes to removable drives

Limits and enforcement

Editing USBSTOR by hand affects the machine, but a local admin can flip it back, and it does not distinguish an approved drive from an unapproved one. Modern device control goes further with per-class rules and allowlisting of specific known devices.

A managed agent applies USB policy across every machine, enforces it for all users, and re-applies it if someone re-enables the driver in Device Manager - with per-class control rather than a single blunt switch.

Block USB storage via the registry, Group Policy, or read-only mode

  1. Disable the USB storage driver - Open regedit and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR. Set the DWORD named Start to 4 to disable USB mass storage (set it back to 3 to re-enable).
  2. Or deny all removable storage via Group Policy - In gpedit.msc go to Computer Configuration > Administrative Templates > System > Removable Storage Access and enable 'All Removable Storage classes: Deny all access'.
  3. Or set drives to read-only - Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies create a DWORD named WriteProtect set to 1 to allow reads but block writes.
  4. Apply the change - Run gpupdate /force or reboot so the driver and policy changes take effect.
  5. Verify - Plug in a USB drive. With storage disabled it should not appear; with read-only set, it should mount but refuse writes. Confirm the keyboard and mouse still work.

Frequently asked questions

Will blocking USB storage disable my keyboard and mouse?

No. Disabling the USBSTOR driver blocks mass storage only. Keyboards, mice, and security keys are separate USB classes and keep working.

What does USBSTOR Start value 4 mean?

Setting the USBSTOR service Start value to 4 disables the USB mass-storage driver. Setting it back to 3 re-enables it.

How do I allow only company USB drives?

The registry switch is all-or-nothing. Per-device allowlisting requires device control that identifies drives by hardware ID, which a managed agent provides.

What is read-only USB mode?

The WriteProtect policy lets users open and copy files from a removable drive but blocks writing to it - the drive mounts but writes fail - so data cannot be copied onto a USB stick and carried off.

Control USB across your whole fleet

CtrlOne offers per-class USB control, read-only mode, and device allowlisting - enforced for every user and re-applied after tampering.