TECHNIG
Gateway for IT Experts and Tech Geeks

How to Prevent Access to Removable Storage Media Using Group Policy?

System admins have the ability to prevent/block users’ access to all removable storage media drives. Such restrictions play an important role in the security and safety of a networked environment. And they are very common and most often used inside almost all organizations. Additionally, the tool that helps us create such restrictions is the Group Policy Management Console (GPMC). It is a feature that we add along with the AD DS role installation. That all being said, this article covers a step-by-step guide to preventing domain-joined users’ access to removable storage media drives using group policy in Windows Server 2022.

In our example, the domain controller machine runs Windows Server 2022 Standard. Additionally, we define the group policy directly on an Organizational Unit (OU) that contains the target users. So, we have already created an OU and moved the target user(s) into it.

You may also like to read DNS Server Guides and DHCP Server Articles.

Steps to Prevent Access to Removable Media

With the above scenario in mind, it is a straightforward process to prevent users’ access to removable media.

  1. Press down the Windows Key + R on your keyboard. It opens the Run dialogue box.
  2. Type in gpmc.msc and press the enter. It opens the Group Policy Management (GPM) console.
Opening Group Policy Management Console from the Run
Opening Group Policy Management Console from the Run
  1. On the group policy management console, right-click on the OU that contains the target users. Then, select Create a GPO… from the context menu.
Creating a Group Policy Associated With an OU
Creating a Group Policy Associated With an OU
  1. Type a name for the new GPO. Then, click OK to continue.
Naming the New GPO
Naming the New GPO
  1. Right-click on the GPO that you created. Then, select Edit from the context menu.
Editing the GPO
Editing the GPO
  1. On the GPM Editor window, expand User Configuration -> Administrative Templates -> System. Then, select the Removable Storage Access folder as shown in the below picture. Finally, double-click on All Removable Storage classes: Deny all access.
Finding the GPO configuration to Deny Access to Removable Media
Finding the GPO configuration to Deny Access to Removable Media
  1. On the GPO configuration window, check the Enabled option. Then, click OK and close the GPM Editor window.
Enabling the GPO to Deny All Access to Removable Storage Media
Enabling the GPO to Deny All Access to Removable Storage Media
  1. The GPO configuration is all set throughout the previous steps. However, it will affect only after we perform a group policy update on the client machine or restart it. So, to perform a group policy update, use gpupdate /force the Command Prompt or Run dialogue box.
Updating Group Policy using Run
Updating Group Policy using Run
  1. Now, if you insert a removable media like a USB drive and try to open it, you will face an error saying the media is not accessible.
Error Accessing Removable Storage After Group Policy Update
Error Accessing Removable Storage After Group Policy Update

That is all with the steps to deny users access to removable storage media using group policy.

Conclusion

To conclude this article, first, we talked about the importance of restricting users’ access and discussed the Group Policy Management tool. Then, we briefly introduced our scenario. Lastly, we covered detailed steps to prevent users’ access to removable storage media.

In the end, as always, I hope you find this article helpful. And feel free to share your thoughts and queries in the comment section.

Leave A Reply

Your email address will not be published.

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More