How to Block Copying to USB Drives in Windows 11 and 10 (Write-Protect)

Don't want anyone copying files from your PC to a USB flash drive? Windows can make all USB drives read-only: people can still open files from a pen drive, but can't copy anything onto it. You can also block USB storage completely. No extra software is needed. This guide shows three methods for Windows 11 and Windows 10, from a quick Registry change to Group Policy for business PCs.

Which method should I use?

Method 1: Make USB drives read-only with the Registry

Open Terminal (Admin) or Command Prompt (Admin) and run:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 1 /f

Unplug the USB drive and plug it in again. Trying to copy a file to it now shows "The disk is write-protected". Opening and copying files from the drive still works.

Prefer doing it by hand? Open regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control, create a key named StorageDevicePolicies if it doesn't exist, and inside it create a DWORD (32-bit) Value named WriteProtect with value 1.

Undo it

reg add "HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 0 /f

Re-plug the drive afterwards.

Method 2: Group Policy (Pro and Enterprise)

1. Press Win+R, type gpedit.msc and press Enter.
2. Go to Computer Configuration > Administrative Templates > System > Removable Storage Access.
3. Open Removable Disks: Deny write access, choose Enabled, and click OK to make USB drives read-only.
4. To block USB drives completely, also enable Removable Disks: Deny read access.

Apply the change immediately:

gpupdate /force

To undo it, set the same policies back to Not Configured. In a company, apply the same policies through a domain GPO or Intune instead of on each PC.

Method 3: Block USB storage completely

This stops Windows from loading the USB storage driver, so flash drives and external disks don't appear at all. USB keyboards, mice and printers keep working.

:: disable USB mass storage (4 = disabled)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f

:: re-enable it (3 = default, load on demand)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 3 /f

Restart the PC or re-plug the drive after changing it.

Check the current state

# read-only setting (1 = on)
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies' -Name WriteProtect -ErrorAction SilentlyContinue

# USB storage driver (3 = enabled, 4 = disabled)
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR').Start

Limitations to know about

• Anyone with an administrator account can undo these settings. Give other people standard user accounts.
• They don't stop copying through other routes: cloud storage, email, Bluetooth, network shares, or phones connected over MTP. For real data protection, use BitLocker for your drives and keep sensitive files in a separate account or encrypted folder.
• Some USB drives have a physical write-protect switch. If a drive is read-only on every PC, check the switch, or the drive may be failing.

Fix "The disk is write-protected" when you didn't set it

If your own USB drive suddenly became read-only:

1. Check the WriteProtect value above and set it to 0.
2. Check for a physical lock switch on the drive or SD card adapter.
3. Clear the read-only attribute with diskpart. Replace 2 with your USB drive's number from list disk (identify it by its size):

diskpart
list disk
select disk 2
attributes disk clear readonly
exit

Questions? Ask in the comments with your Windows edition.