How to disable USB drives

The Network Administrator article wants to introduce two methods to prevent users from connecting to your system with a USB drive. This method also allows you to protect your resources, especially for users who share a computer and don't want others to use USB to copy other important data in the machine.

To disable the use of USB storage devices, use one of the following procedures:

If the USB drive has not been installed on the computer

In this case you specify the user or reject the group in the files below:

• % SystemRoot% InfUsbstor.pnf
• % SystemRoot% InfUsbstor.inf

When doing so, users cannot install a USB drive into the computer. To specify a new user or reject the group in the Usbstor.pnf and Usbstor.inf files, follow these steps:

1. Go to Windows Explorer, then go to the % SystemRoot% Inf folder .

2. Right-click the Usbstor.pnf file and then click Properties .

3. Select the Security tab.

4. In the Group or user names list , click the user or group to which you want to set the denial.

5. In the Permissions for UserName or GroupName list , click to select the Deny check box next to Full Control , and then click OK .

Be sure to add the system account to the Deny list.

6. Right-click the Usbstor.inf file, and then click Properties .

7. Select the Security tab.

8. In the Group or user names list , click the user or group you want to set restrictions on.

9. In the Permissions for UserName or GroupName list , select the Deny check box next to Full Control , and then click OK .

If the USB drive is already installed on the computer

When you do with regedit, there may be dangers to your computer if you do it wrongly, at worst, you may have to reinstall the operating system for your computer. Microsoft also does not guarantee that problems with regedit can be solved. In case the USB drive has been installed on the computer, you should disable it as follows:

1. Click Start , then click Run .

2. Type regedit then click OK .

3. Go to: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUsbStor

4. In the right window, double-click Start .

5. Change the value in the box to 4 then click OK .

6. Exit Registry Editor.

The above procedure applies to later versions

• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Professional Edition
• Microsoft Windows 2000 Server
• Microsoft Windows Server 2003, Enterprise Edition
• Microsoft Windows Server 2003, Standard Edition

Van Linh