Disable Removable Storage Devices Using Regedit

Disabling the installation of removable storage class devices prevents users from connecting external media, such as USB flash drives, external hard drives, and SD cards, to protect organizational data and minimize malware risks. Administrators can enforce this restriction across a Windows system by creating or modifying specific values within the Windows Registry Editor (regedit.exe).

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog.
  2. Type regedit and press Enter.
  3. Select Yes if prompted by User Account Control (UAC) to run the tool with administrative privileges.

Step 2: Navigate to the Device Installation Restrictions Key

In the Registry Editor, use the left sidebar to navigate to the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions

Note: If the DeviceInstall or Restrictions keys do not exist under Windows, right-click the parent key, select New > Key, and name them accordingly.

Step 3: Create the DenyRemovableDevices Value

  1. Right-click the Restrictions key in the left pane or empty space in the right pane.
  2. Select New > DWORD (32-bit) Value.
  3. Name the new value DenyRemovableDevices.
  4. Double-click DenyRemovableDevices, set the Value data to 1, and ensure the base is set to Hexadecimal.
  5. Click OK to save the changes.

Step 4: (Optional) Block Specific Setup Classes

To restrict devices based strictly on device setup class GUIDs rather than the generic removable flag: 1. Under Restrictions, create a new subkey named DenyDeviceClasses. 2. Inside Restrictions, set a DWORD (32-bit) value named DenyDeviceClasses to 1. 3. Inside the DenyDeviceClasses subkey, create new String Values (named 1, 2, 3, etc.) and set their data to the specific class GUIDs to block (e.g., {53f56307-b6bf-11d0-94f2-00a0c91efb8b} for disk drives).

Step 5: Apply the Changes

Restart the computer or open an elevated Command Prompt and execute gpupdate /force to ensure the device installation restriction takes immediate effect. Once applied, Windows will block the driver installation and use of any newly attached removable storage devices.