How to Block USB Ports and Removable Storage on Work Computers: Group Policy, Registry, Intune, macOS and Linux, Step by Step

Why Block USB Ports on Company Devices

A USB port is the one data path on a corporate laptop that does not pass through the network. Email, cloud storage and web uploads can all be filtered and logged centrally; a flash drive cannot. That makes removable media the simplest exfiltration route for a departing employee and the simplest infection route for an attacker, whether through a dropped drive in the car park, a malicious device that presents itself as a keyboard, or an infected drive carried between an unmanaged home machine and the office.

Regulated industries have additional reasons. PCI DSS, HIPAA and most information-security frameworks expect controls on removable media, and auditors ask for evidence that the controls are enforced rather than merely written in a policy. Insider-threat investigations frequently turn on USB activity, which is why the ability to prove that storage devices were blocked, or that transfers to permitted devices were logged, matters as much as the block itself.

Blocking is not all-or-nothing. The methods below can deny all storage devices, allow reading but not writing, permit only specific approved drives, or simply log what happens. Keyboards, mice, webcams and headsets use different USB device classes and are unaffected by storage-class restrictions, so a well-configured block is invisible to most users. Our guide to whether employers can see files copied to USB covers the employee-facing side of the same question.

Decide the Policy Before You Touch a Setting

1. Scope. All devices, or only those handling sensitive data? Most organisations block storage on every managed endpoint and grant exceptions by role.
2. Level. Deny all access; allow read-only; allow only approved devices; or audit only. Read-only stops exfiltration but still permits infection from a malicious file, so deny-all with an allow-list is the usual choice.
3. Exceptions. Which teams need removable media (field engineers, forensics, media production) and which devices they may use. Issue hardware-encrypted drives and allow-list them by serial number.
4. Logging. What is recorded when a permitted drive is used: device identity, file names, sizes and times. This is where endpoint monitoring software takes over from the operating system.
5. Communication. Tell staff what is blocked and why, and how to request an exception, before enforcement begins. A silent block generates help-desk tickets and workarounds; an explained one does not.

Run the chosen control in audit or report-only mode for two weeks first. The log of who is using removable storage today, and for what, usually changes the exception list.

Windows: Block USB Storage With Group Policy

Group Policy is the standard method on domain-joined Windows machines and the one most administrators should use. It blocks storage-class devices only, applies by organisational unit, and is reversible by changing the policy.

1. Open the Group Policy Management Console on a domain controller or a workstation with RSAT, and create or edit a GPO linked to the organisational unit that contains the target computers.
2. Navigate to Computer Configuration > Policies > Administrative Templates > System > Removable Storage Access.
3. Open All Removable Storage classes: Deny all access and set it to Enabled. This blocks USB drives, external hard disks, memory cards, CD and DVD drives and Windows Portable Devices such as phones in storage mode.
4. For a read-only policy instead, leave the setting above unconfigured and enable Removable Disks: Deny write access. Users can read from drives but not copy to them.
5. Optionally enable All Removable Storage: Allow direct access in remote sessions if virtual desktop users need redirected drives.
6. Close the editor and run gpupdate /force on a test machine, or wait for the next policy refresh. Plug in a drive to confirm that Windows reports access denied.

The same settings exist under User Configuration for per-user rather than per-computer enforcement, which is useful when the exception is a person rather than a machine. Settings apply only to devices connected after the policy refresh; a drive already mounted stays accessible until it is removed.

On a standalone machine without a domain, open the Local Group Policy Editor with gpedit.msc and follow the same path. Windows Home editions do not include the editor; use the registry method below.

Windows: The Registry Method

Two registry approaches exist. The first mirrors the Group Policy setting and is the one to script if you cannot use GPO. Create the key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices and a DWORD value named Deny_All set to 1. Restart or sign out to apply. Setting it to 0 or deleting the value restores access.

The second is the blunt switch that disables the USB mass-storage driver entirely. Open HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR and change the Start DWORD from 3 to 4. Windows will no longer load the driver for any USB storage device. Set it back to 3 to re-enable. This method stops every USB disk including ones you might want to allow-list later, does not affect memory cards or phones that use other drivers, and can be reversed by any user with local administrator rights, so treat it as a fallback for kiosks and locked-down machines rather than a fleet policy.

Both values can be deployed through Group Policy Preferences, a configuration management tool or a signed PowerShell script. Document whichever you use; a registry change with no record is the first thing a future administrator will undo.

Windows: Intune and Defender for Endpoint Device Control

For cloud-managed devices, Intune provides two routes.

Device restrictions profile. In the Intune admin center go to Devices > Configuration > Create > Windows 10 and later > Device restrictions, open the General section and set Removable storage to Block. Assign the profile to a device group. This is the equivalent of the deny-all Group Policy and is enough for most organisations. The settings catalog also exposes the individual Removable Storage Access policies if you want read-only rather than deny-all.

Defender for Endpoint device control. Under Endpoint security > Attack surface reduction > Device control you can build rules that allow, deny or audit read, write and execute access by device class, vendor ID, product ID or serial number, and show users a custom message with a link to the exception process. This is the method to use when you need an allow-list of approved encrypted drives, because it enforces the list on the device even when it is off the corporate network, and it writes an event for every blocked and permitted connection that flows into the Defender portal. Start with the audit setting, review the report, then switch the default rule to deny.

Whichever route you choose, do not also apply the Group Policy block to the same devices. Overlapping controls from two systems produce confusing results when one is later changed.

macOS: Options for Blocking USB Storage

Apple deprecated the native MDM media-management restriction keys beginning with macOS Big Sur, and configuration profiles that once blocked external disks are no longer reliable on current releases. Jamf Pro on its own cannot enforce a storage block through a profile; the community-supported workarounds using launch daemons to force drives read-only are fragile across updates. Organisations that need enforcement on Macs use one of three approaches.

• Microsoft Defender for Endpoint device control for macOS. A JSON policy, validated against Microsoft's schema and deployed as a Defender preference through Jamf or Intune, can audit, allow or block read, write and execute access to removable storage, with rules by vendor, product and serial number and a redirect URL for blocked devices. It is the closest equivalent to the Windows control and reports into the same portal.
• Jamf Protect. Jamf's endpoint-security product includes removable-storage controls that Jamf Pro lacks, with allow-listing and read-only options.
• Third-party device control. Dedicated tools such as Endpoint Protector, and the open-source Santa agent which added USB mass-storage blocking in 2022, cover Macs alongside Windows and Linux from one console.

Whichever you pick, test with the current macOS release before rollout and again after each major update; this is the platform where removable-media controls have broken most often.

Linux: modprobe and USBGuard

On Linux workstations the simplest block is to prevent the usb-storage kernel module from loading. Create /etc/modprobe.d/block-usb-storage.conf containing install usb-storage /bin/false, then unload any running instance with modprobe -r usb-storage. Also blacklist uas, the newer USB-attached-SCSI driver, or fast external SSDs will still mount. This stops storage devices while leaving input devices alone, and it survives reboots.

For allow-listing rather than a blanket block, deploy USBGuard, which authorises USB devices against a rules file by vendor, product and serial and can be managed centrally. Its default policy after installation is to allow devices already present and block new ones, which is a reasonable starting point for a managed fleet.

Allow-Lists, Encryption and Exceptions

Most organisations end up with a small set of approved drives. The practical rules:

• Allow-list by serial number, not vendor or product, so that an identical model bought by an employee does not inherit the exception.
• Issue hardware-encrypted drives for exceptions, or enforce encryption with BitLocker To Go on Windows (the policy Deny write access to removable drives not protected by BitLocker allows writes only to encrypted drives), so a lost drive is not a breach.
• Time-limit exceptions and review them quarterly.
• Keep the exception process short. A form, a manager approval and a 24-hour turnaround. Long waits produce personal cloud uploads instead, which are harder to see.

Note that blocking USB storage does not block file transfer by other means. Phones connected as media devices, Bluetooth file transfer, personal email, consumer cloud storage and screenshots all remain. Device control is one layer of a data-loss-prevention programme, not the whole of it; our guide to the best monitoring tools for data loss prevention covers the others.

Log What the Block Allows Through

Operating-system controls answer the question “was the device blocked?” They do not answer “what was copied to the device we allowed?”, which is the question that matters in an investigation. Endpoint monitoring software fills that gap by recording, for every permitted removable drive, the device identity, the files written to it, their size and the time, and by alerting when the volume or sensitivity of transfers is unusual.

E-Monitor's USB blocking software applies the block policy itself on Windows, macOS and Linux endpoints and logs transfers to any allow-listed device, and its file access monitoring connects those events to the files and folders involved. Together with activity logs, that gives an auditable record of removable-media use that satisfies the evidence question auditors and investigators actually ask. For the wider programme, see our guide to the best insider threat monitoring tools.

Frequently Asked Questions