Group Policy to disable USB Drives

simple effective and free way to block these as well as other forms of removable media on a windows computer.

1.	Create a GPO The first step is to open Group Policy Management and create a new GPO. I typically like to create 2 GPO's One for blocking read access and one for blocking write access. By Creating 2 separate policies I can apply each individually so I can allow read access for certain groups of users while blocking write access and I can apply both policies to other groups so I can block all access. The policy we are about to create is user based This means that it will apply to the users and not the computer. This means we can block access as need for normal users on a computer while still allowing access for other users like say IT (ourselves) so we can still do our thing without any issues. These policies apply to all forms of removable media not just USB based media. therefor you can use them to block other media access such as CD and DVD access as well.
2.	Set the Desired Policy Items In your GPO browse to the following location. User Configuration > Policies > Administrative Templates > System > Removable Storage Access If you look through the list of options you will see 2 choices for each media type. One choice when enabled blocks write access and the other choice blocks read access. In my attached image i show an example of blocking all read access. Therefor to block read access to each of these media types simply enable the deny read access item for each. If you want to block write access enable the block write access options. If you want to block both the enable both options. Its really that simple. ---------------------------------------------------------------- Note: For some reason Digital cameras require both read and write access. So if you have users that need access to a digital camera directly through the camera's USB connection they will need read and write access. Even if all they want to do is read files from the camera. However if you remove the memory card from the camera and read it with a memory card reader it only needs read access as expected. Within the Group Policy Editor, navigate to  \Computer Configuration\Policies\Administrative Templates\System\Removable Storage Access. NOTE: If you prefer to set these restrictions on a per-user basis instead of computer-wide, then use the Group Policy path  \User Configuration\Policies\Administrative Templates\System\Removable Storage Access. Group Policy – Removable Storage Access Note from the above screenshot that we can use Group Policy to limit access to the following device classes: Naturally, we want to apply GPO security filtering to ensure that only our desired users and computers are affected by our new policy. From the Group Policy Management Console we can make use of theSecurity Filtering and/or the WMI Filtering areas to properly scope our GPO. This is depicted in the following screen image: In order to put your new GPO into effect immediately, open an administrative command prompt and issue the following command: gpupdate/ force This command refreshes Group Policy throughout your Active Directory domain.
3.	Apply the GPO Now that you have created your GPO Policy (or policies if you want more granular control like I did) all that you need to do is apply the GPO to the Users you wish to restrict removable media for by assigning it the correct OU's. Once applied simply wait for the policy to update on the users computer or run "gpupdate /force" to speed things up and test it out. How the restriction works Once your GPO has been ingested by your domain, a user will see the following message box whenever they attempt to mount a restricted media device: In Local non domain computers Go to the client machine and go to start button and type in to search box gpedit.msc then your group policy window will open left side of window - search application templates and double click on it then click on system next you will see removable storage access just click on it then you will see lots of group policy name see the all removable storage access: deny all access double click on it and select the option enable and click on OK button you will success to block USB of client