Enable USB Write Protection in Windows 11 and 10: Every Way

You can make Windows 11 or Windows 10 refuse to write to any USB drive plugged into a PC, so nobody can copy files off it onto a stick, in four ways: a Group Policy called Removable Disks: Deny write access (Pro, Enterprise and Education), a registry value called WriteProtect under StorageDevicePolicies (any edition, including Home), a BitLocker policy that makes every drive read-only unless it is encrypted with your organization's BitLocker, or Microsoft Defender for Endpoint device control for a managed fleet. This is USB write protection on the computer, not on the drive: the stick still works normally everywhere else. The surprise that the old version of this guide did not know: the classic registry trick does not cover every USB drive on modern Windows. Drives that attach through the newer USB Attached SCSI driver, which includes most external SSDs and many fast sticks, ignore it. The policy methods cover them; the registry alone does not. If you came here because Windows says your own drive is write-protected and you want that removed, that is the sister guide, linked below.

Jake's shop keeps one PC at the counter for customer devices: phones to back up, laptops to diagnose, drives to recover. The week a customer's "just copying my photos" turned into a folder of the shop's own invoices leaving on a flash drive, Ethan decided the counter PC would never write to a USB stick again. Jake found a 2016 tutorial, this one in fact, added the registry value, tested it with a cheap stick, and declared it done. Two days later a customer copied a file to an external SSD without a single error. Nothing was wrong with the registry entry. The SSD simply used a different driver, and the registry value had never applied to it. "So we locked the front door," Ethan said, "and left the side door open with a sign on it." This rewrite is the version that locks both.

One thing to get straight before anything else, because the two problems share every keyword and none of the fixes. This page is about enabling write protection on a computer: making the PC treat every removable drive as read-only, on purpose. If the situation is reversed, your USB stick or SD card says "the disk is write-protected" and you did not ask for that, read our guide to removing write protection from a USB drive, which walks through diskpart, the physical lock switch and the registry in that direction. If you enable something on this page and later forget, that guide is also how you find your way back.

What USB write protection on a PC actually does

Windows has a small set of controls that decide what a removable drive may do once it is plugged in: whether it can be installed at all, whether it can be read, and whether it can be written to. "Write protection" here means the third one: the drive appears in File Explorer, you can open and copy files from it, but any attempt to save, paste, delete or format returns an error that the disk is write-protected. It is enforced by Windows on that computer, so the same stick behaves normally on any other machine. That is exactly what you want for a shared PC, a kiosk, a kid's laptop, or Jake's counter machine: keep reading working, stop the outbound copy.

Four mechanisms do this, and they are not equal. The table is the whole decision; the sections after it are the steps.

Method 1: Group Policy, Removable Disks: Deny write access

This is the setting Microsoft built for the job, and it is the one to use whenever the edition allows it. It applies to the whole computer, every user who signs in, and every device Windows classes as a removable disk regardless of the driver underneath, which is what makes it better than the registry trick.

1. Press Win + R, type gpedit.msc, press Enter. (On Home this opens nothing; use Method 2.)
2. Go to Computer Configuration > Administrative Templates > System > Removable Storage Access.
3. Double-click Removable Disks: Deny write access, choose Enabled, then OK.
4. Apply it now without a restart: open an administrator Command Prompt and run gpupdate /force, then unplug and re-plug the test drive.

Test it the way Jake should have: with an ordinary stick and an external SSD. Copying to either should fail with the write-protected message, while opening files from both still works. If you also want to stop reading, the same folder has Removable Disks: Deny read access, and All Removable Storage classes: Deny all access blocks everything in the category at once. Note the separate WPD Devices policies in that folder for phones and cameras that connect over MTP or PTP; Microsoft's own documentation warns that WPD policy is not a reliable way to block removable storage, because a phone that presents itself as a disk can still be browsed in File Explorer. Treat the WPD settings as an addition to the Removable Disks policy, not a substitute.

Under the hood, this policy writes a registry key of its own, Software\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} with Deny_Write set to 1, under HKEY_LOCAL_MACHINE. On a Home PC you can set that key by hand and it is honored the same way; it is simply less discoverable than the policy editor, and it is the better Home option when the drives you want to block are not ordinary sticks.

Method 2: the registry, and the drive it does not cover

This is the 2016 method, updated. It works on every edition and takes a minute, and you should know its limit before you trust it. Open Registry Editor as an administrator (Win + R, regedit), then:

1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control.
2. If there is no key named StorageDevicePolicies, right-click Control, choose New > Key, and name it exactly that.
3. Inside it, right-click the empty right pane, New > DWORD (32-bit) Value. Choose the 32-bit DWORD even on 64-bit Windows.
4. Name it WriteProtect and set its value to 1.
5. Unplug and re-plug any connected drive. Drives already mounted keep their old state until they reconnect.

Or the same thing in one line from an administrator Command Prompt:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 1 /f

Now the limit. Windows attaches USB storage through one of two drivers. Ordinary flash drives, card readers and older enclosures use the classic USB mass-storage driver, and their device path in Device Manager begins with USBSTOR\. Faster drives, including most external SSDs and many USB 3 sticks and enclosures, use USB Attached SCSI (UASP), and their path begins with SCSI\. Since Windows 8, the WriteProtect value is honored by the first driver and ignored by the second. So a policy that appears to work with the stick in your drawer can quietly fail on the customer's SSD, exactly as it did for Jake. To see which driver a drive uses, open Device Manager, find it under Disk drives, open Properties > Details, and read Device instance path. If you own a Home PC and the drives you need to block include UASP devices, use the policy registry key from Method 1 instead of this one; it is edition-independent and driver-independent.

Two more honest notes on this method. It is a system-wide switch with no exceptions: your own backup drive becomes read-only too, until you flip it back. And because it lives in the registry, any administrator on the PC can reverse it in thirty seconds; it stops accidents and casual copying, not a determined insider with admin rights.

Method 3: BitLocker, "deny write access to drives not protected by BitLocker"

Blocking every write is blunt. Many organizations want a subtler rule: staff may carry data out on a USB drive, but only an encrypted one, so a lost stick is a lost stick and not a breach. BitLocker To Go has a policy for exactly that. When it is enabled, every removable data drive is mounted read-only unless it is BitLocker-protected; a protected drive gets full read and write. There is a further option, Deny write access to devices configured in another organization, which allows writes only to drives whose BitLocker identification field matches your organization's, set with the companion policy "Provide the unique identifiers for your organization" and stamped onto drives with manage-bde.

1. In gpedit.msc (or the equivalent domain GPO), go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives.
2. Enable Deny write access to removable drives not protected by BitLocker. Tick the "configured in another organization" option only if you have set identification fields.
3. Apply with gpupdate /force, re-plug a drive, and read the prompt: Windows offers to encrypt the drive with BitLocker before allowing writes, and mounts it read-only if the user declines.

Two facts from Microsoft's BitLocker reference belong in your runbook. If you use this policy, the use of recovery keys on removable drives must be disallowed in the recovery-options policy for removable drives. And the same "deny write access" behavior can be set through Intune and the BitLocker CSP, so it works on cloud-managed devices with no domain. If BitLocker is new to you, our plain guide to BitLocker and device encryption covers the basics, and know where your recovery keys live before you encrypt anyone's drive.

Method 4: block the drive from installing at all

Sometimes read-only is not enough and you want the stick to do nothing: no drive letter, no browsing, no reading. That is Device Installation Restrictions, a different folder of Group Policy that decides which devices Windows may install a driver for. Find it under Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions. The blunt setting is Prevent installation of removable devices; the precise ones block by device setup class, by hardware ID, or by device instance ID, so you can block every USB disk and allow one specific company-issued model by its hardware ID, which looks like USBSTOR\DiskGeneric_Flash_Disk______8.07 in Device Manager. Three things to know from Microsoft's own walkthrough: the policies apply to the computer, never per user, with one exception, Allow administrators to override Device Installation Restriction policies, which exempts local administrators; a "Prevent" policy blocks future installs only unless you tick also apply to matching devices that are already installed; and the modern way to combine broad blocks with narrow allows is the Apply layered order of evaluation policy, which evaluates instance IDs over device IDs over setup classes over the removable-devices catch-all. Ordinary users cannot get around this one with a registry edit, because a driver that is not allowed to install never creates a drive to write to.

Method 5: Defender for Endpoint device control, for a managed fleet

Everything above is a per-machine setting with no memory. If you manage dozens or thousands of PCs and need to say "marketing may write to encrypted drives, finance may read only, this one serial number is allowed everywhere, and log every attempt," the tool is device control in Microsoft Defender for Endpoint. It restricts removable media, portable devices, CD/DVD and printers with rules on device ID, vendor and product ID, serial number, the operation (read, write, execute), the user or group, the network location, and even the file type; it can audit instead of block; and every triggered policy lands in Advanced Hunting as a RemovableStoragePolicyTriggered event you can query. It is configured through Intune, the Defender portal or Group Policy, and it needs a Defender for Endpoint license and a recent anti-malware client, with Windows 10 and 11 supported and servers not. For file-level control, "block copying of files classified as confidential to USB," the layer above it is Endpoint DLP in Microsoft Purview. Neither is a home tool; both are what the compliance officer means by "USB write protection software" when they say it in a meeting.

How to check it worked, and how to see who tried

Test with the drive types you actually have, and test as a standard user, not only as yourself. A quick script from an administrator PowerShell tells you what Windows thinks of each connected drive:

Get-Disk | Select-Object Number, FriendlyName, BusType, IsReadOnly
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" -ErrorAction SilentlyContinue

The first line shows the bus type for each disk (USB for classic mass storage, and UAS for USB Attached SCSI, which is the one the registry method misses). The second and third show which of the two switches is set. Then try to create a file on each drive from a standard account; the error should be the write-protected message, not "access denied," which would mean an NTFS permission problem instead. For a record of attempts, the Removable Disks policy does not log by itself; if you need to know who tried, that is the Defender device-control route, or at minimum enabling object-access auditing for removable storage under Advanced Audit Policy Configuration > Object Access > Audit Removable Storage, which writes event 4663 for each access attempt.

How to turn USB write protection back off

• Group Policy: set Removable Disks: Deny write access back to Not Configured (not merely Disabled, if a domain policy might set it), run gpupdate /force, and re-plug the drive.
• Registry: set WriteProtect to 0 or delete the value: reg delete "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /f. Re-plug the drive.
• BitLocker policy: set the deny-write policy to Not Configured; drives that were encrypted stay encrypted and keep working.
• Managed PC: if the setting is grayed out or comes back after every restart, a domain GPO or Intune profile owns it, and it must be changed there. Our guide to settings managed by your administrator explains how to tell which.

If a drive stays read-only after you have undone everything on this page, the protection is on the drive rather than the PC, a lock switch, a controller fault, or a flag set by another machine, and the removal guide takes over from here. And if you made registry changes you no longer remember, restoring the registry from a backup is the safe reset.

Whichever switch you set, the undo is the same switch set back, and the table above is where to look when a drive is read-only and nobody remembers why.

Do you need a USB write protection tool or software?

Search results for this topic are full of small utilities that promise "USB write protect" in one click. Most of them do nothing more than set the StorageDevicePolicies value from Method 2, with the same UASP blind spot and a download you did not need. A few older ones edit the registry in ways that leave the key behind after uninstall. For a single PC, the built-in methods above are the tool. For a company, the tools are Group Policy, Intune and Defender device control, which are also built in to what you already pay for. The one genuinely different category is hardware: USB sticks with a physical write-protect switch, and forensic write-blocker devices that sit between a drive and the PC and refuse writes in hardware, used when the drive itself must be provably untouched, which is a different job from protecting the PC.

For IT admins: rolling out USB write protection across a company

1. Decide the policy in one sentence first. "No writes to removable media" is the Removable Disks policy. "Writes only to encrypted media" is the BitLocker policy. "Per-device and per-user exceptions with logging" is Defender device control. Mixing all three without a plan produces tickets, not security.
2. Deploy by GPO or Intune, never by hand. Domain: link the GPO to the OU of the computers, not the users, because these are Computer Configuration policies. Intune: the settings catalog under Administrative Templates > System > Removable Storage Access, or the Storage CSP's RemovableDiskDenyWriteAccess. One machine under both GPO and Intune device control applies only the GPO settings, so pick one channel.
3. Do not rely on StorageDevicePolicies in a fleet. It misses UASP drives and any local administrator can flip it. It is a Home-PC convenience, not a control.
4. Handle the exceptions before they arrive. Photographers, engineers with instrument dumps, and anyone who images machines will need a way out: an allow-listed device ID through Device Installation Restrictions or device control, or BitLocker-encrypted company drives. Decide it now, or the first exception request becomes a policy rollback.
5. Turn on auditing. Audit Removable Storage (event 4663) at minimum; device-control Advanced Hunting queries for the full picture. A policy nobody can see working is a policy nobody will keep.
6. Test on the real drive mix: a classic stick, a UASP SSD, a phone over MTP, an SD card in a built-in reader, a BitLocker-encrypted drive. Each of those takes a different path through Windows, and the counter-PC lesson is that one passing test proves one path.

Ethan's counter PC now runs the Group Policy setting, with one company-issued BitLocker drive on the allow list for the times Jake genuinely needs to carry something out. The test he runs after every Windows update takes a minute: one stick, one SSD, one phone, all read-only. "Locking the front door was never the hard part," he says. "Knowing there was a side door was." Pick the method that matches your edition and your threat, test it on more than one kind of drive, and write down how to undo it before you need to.

Revision note. This guide was first published in November 2016 as a registry-only tutorial. It was rewritten on September 29, 2026 for Windows 11 and Windows 10 from Microsoft's Storage policy CSP, BitLocker configuration, device installation and Defender for Endpoint device control references, adding the Group Policy, BitLocker, device-installation and managed-fleet methods, the UASP limitation of the registry method, testing and undo steps, and an IT admin section.