Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our company are currently in the process of rolling out authorised encrypted USB sticks. We have now drafted into the IT policy that only company approved USB devices and removable media are allowed to be connected to the computers, however I was wondering if there was any way of restricting the use of USB drive to only those approved for use. Ideally this would involve group policy settings rather than a 3rd party software if possible.

share|improve this question

migrated from Mar 12 '12 at 13:44

This question came from our site for computer enthusiasts and power users.

up vote 2 down vote accepted

Device Management and Installation Step-by-Step Guide: Controlling Device Driver Installation and Usage with Group Policy

Assuming your clients are all Vista or better, you can use this guide to "whitelist" the set of USB devices your company is deploying and block the rest. From the article:

This step-by-step guide describes how you can control the installation and use of devices on the computers that you manage. In Windows Server® 2008 and Windows Vista® you can apply computer policy to:

  • Prevent users from installing any device.
  • Allow users to install only devices that are on an "approved" list. If a device is not on the list, then the user cannot install it.
  • Prevent users from installing devices that are on a "prohibited" list. If a device is not on the list, then the user can install it.
  • Deny read or write access to users for devices that are themselves removable, or that use removable media, such as CD and DVD burners, floppy disk drives, external hard drives, and portable devices such as media players, smart phones, or Pocket PC devices.
share|improve this answer
I was thinking the same thing, the catch with this approach is to defeat it, a user just needs to purchase the same make/model memory stick. Also it is possible you could purchase a second "identical" batch a period later and find they have different id's creating extra work. – Robin Gill Mar 12 '12 at 19:08
I'm not positive (having never actually used this feature), but I was under the impression that you can restrict down to the unique instance of a device provided some portion of their PnPID is unique. If the device manufacturer doesn't include something like a serial number in the PnPID, it wouldn't be possible though. – Ryan Bolger Mar 12 '12 at 21:48
I've never actually tried to look a unique number/serial myself so I could be wrong - my experience of this was the other way round - allowing certain hardware ID's to be installed to locked down PC's. – Robin Gill Mar 12 '12 at 23:03

In Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives, you will find settings enabling you to deny write access to drives not encrypted with BitLocker and to deny write access to encrypted drives that don't belong to your organization.

share|improve this answer

I am not aware of any group policies that allow this, however McAfee's device control (and several security products from other vendors) provide this functionality.

share|improve this answer

I was tasked with finding the same thing in my organization. I set a Group Policy since Win7 and 2008 and later have a policy for blocking USB access by user groups.

Check this out:

Although I successfully blocked USB thumbdrives and Android devices, I was still able to mount Apple iPHone/iPod as storage devices. We also had problems with some users who have laptop docking stations' NICs not functioning correctly. I have since removed this policy and may look in to third party applications for this endeavor. It sounds like you are also wanting to white list select devices cleared by your IT dept., in which case, you may want to look in to a third party solution instead of using GPO alone.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.