How to Block USB Storage Devices in Windows USB storage devices remain one of the most common malware entry points and data exfiltration vectors in enterprise environments. Blocking removable storage is a common baseline control, especially for regulated or high-risk endpoints. In this video, we’ll walk through six supported methods to block USB storage devices on Windows. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. How to Block USB Devices via Intune and Defender Method 1: Using Microsoft Intune (Administrative Templates) Administrative templates are one of the simplest ways to block USB storage at scale. Sign in to the Intune admin center. Go to Devices > Configuration > Create > New policy. Set Platform to Windows 10 and later. Set Profile type to Templates > Administrative Templates, then click Create. Open Basics, enter a name and description, then click Next. In Configuration settings, expand the General section and locate Removable storage. Select Block. Under Assignments, select the device groups that should receive the policy. Review your configuration and click Create to deploy. Once assigned, Intune enforces the policy across the targeted devices based on check-in timing. Method 2: Using Defender for Endpoint Device Control Rules This method allows for more granular device control using Defender policies. Sign in to the Intune admin center. Go to Endpoint security > Attack surface reduction. Click + Create Policy. Set Platform to Windows 10, Windows 11 and Windows Server, and Profile to Device Control. Name the policy and click Next. Under Configuration settings, go to Storage. Find Removable Disk: Deny Write Access and set it to Enabled. Click Next, then assign the policy to an Entra security group. Review the summary and click Create. Method 3: Using Group Policy (GPO) Press Win + R, type gpedit.msc, then press Enter. Navigate to Computer Configuration > Administrative Templates > System > Removable Storage Access Enable one or more of these policies depending on your goal: All Removable Storage classes: Deny all access Removable Disks: Deny read access Removable Disks: Deny write access If you’re using domain GPO, link the policy to the correct OU. Restart the device to ensure the policy fully applies. Method 4: Using the Registry Editor For environments without centralized tools, you can enforce USB storage restrictions directly through the registry. Press Win + R type regedit, then press Enter. Navigate to: If the key doesn’t exist, create it. Create or modify these DWORD values: Deny_All = 1 blocks removable storage for all users Allow_Admins = 0 ensures administrators are also blocked Restart the device to apply changes. Method 5: Using PowerShell In essence, you’ll open PowerShell as Administrator, then configure the USBSTOR service to either disable or enable USB storage. Here’s one example that disables USB storage by setting the USBSTOR service to a disabled state and stopping the service: For the full set of scripts, including re-enable commands, verification checks, and logging examples, refer to the blog linked in the description. Method 6: Using Command Prompt You can also use Command Prompt to change the USBSTOR value. Follow these steps: Open Command Prompt as Administrator. Use the reg add command to modify the USBSTOR Start value. Run gpupdate /force if needed to refresh policy. Verify the registry value to confirm enforcement. Restart the device if changes don’t apply immediately. Here’s one example that disables USB storage drivers: Windows gives administrators multiple ways to restrict USB storage access. Each method targets a different management scenario, from cloud-managed environments to standalone systems with no centralized tooling. For more information, check out our official blog post on how to block USB storage devices via Intune and Defender for Endpoint, linked in the description below.