You can implement security policies using Active Directory Group Policy Objects (GPO) to block write permissions on USB storage devices while allowing read access only. This is an effective security measure for preventing data exfiltration and malware infections.

Method 1: GPO Configuration via Computer Configuration

Step-by-Step Setup Process

1. Open Group Policy Management Console
   • Run gpmc.msc on your domain controller
   • Create a new GPO or edit an existing one
2. Navigate to GPO Policy Path

   Computer Configuration > Policies > Administrative Templates > System > Removable Storage Access
   

3. Configure USB Write Block Policy
   • Double-click the Removable Disks: Deny write access policy
   • Set to Enabled
   • Click Apply > OK

Available Policy Options

GPO Application and Linking

1. Link GPO to OU
   • Right-click target OU → “Link an Existing GPO”
   • Select your created GPO
2. Force Policy Update

   gpupdate /force
   

Method 2: GPO Configuration via User Configuration

Configuration Path

User Configuration > Policies > Administrative Templates > System > Removable Storage Access

Computer Configuration vs User Configuration Comparison

Method 3: Direct Registry Configuration

Registry Key Location

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices

Manual Registry Setup

1. Run regedit
2. Navigate to the above path (create keys if they don’t exist)
3. Create DWORD values:

Method 4: Exception Handling for Specific Users/Groups

Security Filtering Configuration

1. Create Exception Group
   • Create a new security group in Active Directory Users and Computers
   • Example: “USB_Access_Allowed”
2. Configure GPO Security Filtering
   • Select GPO → Security Filtering section
   • Add “USB_Access_Allowed” group
   • Go to Delegation tab → Click Advanced
   • Set “Apply group policy” permission to Deny for this group

Permission Settings Table

Method 5: Allow Only BitLocker-Protected Drives

Policy Configuration

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives

• Enable Deny write access to removable drives not protected by BitLocker
• Only allows write access to BitLocker-encrypted USB drives

Configuration Verification and Testing

Verify Policy Application

# Check currently applied policies
gpresult /r

# Detailed policy information
gpresult /h report.html

Functional Testing

1. Connect USB device
2. Attempt to copy files
3. Expected results:
   • Read: Normal operation
   • Write: “Access is denied” error or “Administrator permission required” message

Troubleshooting

When Policy Doesn’t Apply

Registry Key Creation Errors

• Manually create StorageDevicePolicies key if it doesn’t exist
• Ensure running with administrator privileges

Related Links

• Microsoft Docs – Group Policy Management
• Microsoft Docs – Removable Storage Access
• Group Policy Administrative Templates