Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to restrict users from formating drives? Computers are in a domain environment. May I use GPO or something else?

I'm trying to hide an HDD partition. We use truecrypt and token, and if the drive is not mounted, and user tries to open the encrypted partition, Windows wants to format it. I'm trying to prevent accidental formats.

share|improve this question
Can you be more specific regarding what type of drives you're referring to: fixed disks (HDD) or removable (USB). – joeqwerty Oct 15 '10 at 10:56

If the users are limited users, that is not members of the local group Administrators, they will not have sufficient access to format an attached disk. Should you desire to control access for formatting removable media, you can use either domain or local Group Policy:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Devices: Allowed to format and eject removable media

Setting this option to either "Administrators" or "Administrators and Power Users" will prevent limited users from formatting this media as well.

See this Technet article for details.

alt text

share|improve this answer

You mean restrict them from formatting USB drives? Things I've heard of having been done involve gluing ports shut, and/or removing drivers for USB controllers.

As of server 2003 (at least) it looks like there's a way to restrict the drivers in GPO. A quick google came up with

There may be other versions or slightly altered instructions if you google for "gpo restrict usb." I don't always trust AD because we have had machines that didn't always "take" properly.

Be aware that unless the machine's BIOS is passworded and set to bypass USB and CDROM at boot, a user could still boot from a bootable disc and format things that way (unless you physically blocked the ports) or format the hard disk. Placing this restriction on users just adds another hurdle. It's not a guaranteed stopping measure.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.