Why Block USB Drives?
USB storage devices are the easiest way to steal data from a computer. An employee copies client files to a thumb drive and walks out. An attacker drops an infected USB in the parking lot and someone plugs it in. Every major compliance framework (NIST 800-171, ISO 27001, HIPAA) requires controls on removable storage devices.
Method 1: Sherlock Forensics USB Blocker (Recommended)
Sherlock Forensics USB Blocker blocks USB storage devices at the IOCTL driver level. This is lower than the file system, which means the block cannot be bypassed by formatting the drive or using alternative file explorers.
Step-by-step
- Download USB Blocker. Get it from our product page. Single .exe, about 10 MB.
- Run as administrator. The application detects all connected USB storage devices.
- Select and block. Choose which drives to block. Click Block. The drives become inaccessible at the driver level.
- Verify. Try to copy a file to the blocked drive. The operation fails immediately.
The free version handles basic blocking and unblocking. The Pro Edition ($39 one-time) adds device whitelisting by serial number, audit logging, tamper protection and silent deployment.
Method 2: Windows Group Policy
Windows Pro and Enterprise editions include Group Policy controls for removable storage:
- Press Win+R, type gpedit.msc, press Enter.
- Navigate to Computer Configuration > Administrative Templates > System > Removable Storage Access.
- Enable Removable Disks: Deny read access and Removable Disks: Deny write access.
Limitations: This is all-or-nothing. You cannot block one USB drive and allow another. It does not work on Windows Home edition. Any user with local admin privileges can reverse it. There is no audit trail of who changed the policy or when.
Method 3: Registry Edit
You can disable the USB storage driver directly in the Windows Registry:
- Press Win+R, type regedit, press Enter.
- Navigate to HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR.
- Change the Start value from 3 (enabled) to 4 (disabled).
- Restart the computer.
Limitations: This blocks ALL USB storage devices with no exceptions. There is no per-device control. Any admin can reverse it. One wrong registry edit can break other system services. There is no logging of when the change was made or who made it.
Comparison
| Feature | USB Blocker | Group Policy | Registry |
|---|---|---|---|
| Per-device control | Yes | No | No |
| Audit logging | Yes ($39 Pro) | No | No |
| Tamper-evident audit log | Yes ($39 Pro) | No | No |
| Works on Home edition | Yes | No | Yes |
| Bypass difficulty | High (IOCTL) | Low (admin) | Low (admin) |
Also handling email evidence? See how to open PST files without Outlook. Opening PDFs from unknown sources? Read how to safely open unknown PDFs.
Blocking USB Devices Across a Fleet
The three methods above block USB devices on a single machine. To block USB devices across a domain or a fleet of endpoints, the trade-offs change. Group Policy scales through Active Directory but only where every machine is domain-joined and running a Pro or Enterprise edition; a local administrator can still reverse it. The registry method reaches the Home editions that Group Policy cannot, but pushing and auditing a registry value across hundreds of endpoints needs a configuration-management layer of its own. Sherlock Forensics USB Blocker blocks USB devices at the storage class as a running service rather than a single registry or GPO value, so the one-line reversal that flips the registry method back does not undo it. It runs in user-mode above the hardware layer, so a determined administrator with kernel-level tools can still bypass it.
GPO vs registry vs per-device blocking
Group Policy and the registry both block USB devices coarsely: mass storage is on or off for the whole machine. Neither can allow one sanctioned encrypted drive while blocking the rest. Per-device blocking reads the device instance path at the IOCTL layer, so a specific hardware ID can be allowed while every other USB storage device stays blocked. That distinction is what lets you block USB data theft without stopping the sanctioned backup drive.
Read-only USB vs a full block and the audit trail
Some investigations need read-only USB rather than a full block, so existing files can be copied off the drive but nothing can be written back. A full block refuses the device outright. Where you have to prove the control held, an audit log of every blocked USB device insertion, with timestamp and hardware ID, is the compliance artifact HIPAA, PCI-DSS and SOC 2 reviewers ask for. Group Policy and registry edits leave no such record; USB Blocker Pro writes one.
When each method to block USB devices fails
Group Policy fails on Home editions and on any machine that leaves the domain. The registry method fails the moment a user with local admin flips the value back. Both fail silently, with no alert that USB devices are no longer blocked. Running as a service means the one-line registry or GPO reversal does not switch it off; the Pro audit log records the attempt. It is still a user-mode control, so a determined administrator with kernel-level tools can bypass it.
Frequently Asked Questions
Can I block USB drives but allow keyboards and mice?
Yes. Sherlock Forensics USB Blocker targets USB mass storage devices only. HID devices (keyboards, mice, webcams) are unaffected. The blocking operates at the storage class level, not the USB port level.
Does blocking USB work on Windows Home?
Group Policy (gpedit.msc) is not available on Windows Home edition. The registry method and Sherlock Forensics USB Blocker both work on all editions of Windows including Home.
Can users bypass USB blocking?
Registry edits and Group Policy settings can be reversed by any user with local admin privileges. USB Blocker Pro runs as a service rather than a single registry value, so that one-line reversal does not undo it; the Pro audit log records every attempt (tamper-evident). It is a user-mode control, so a determined administrator with kernel-level tools can still bypass it.
How do I block USB devices across an entire domain or fleet?
Group Policy pushes a USB block through Active Directory to every domain-joined Pro or Enterprise machine, but not to Home editions and not against a local admin who reverses it. For mixed fleets or tamper resistance, deploy Sherlock Forensics USB Blocker, which runs as a service (so the one-line registry reversal does not undo it) and logs every attempt to its audit trail. It is a user-mode control, so a determined admin with kernel-level tools can still bypass it.
What is the difference between blocking USB devices and read-only USB?
A full block refuses USB storage devices outright. Read-only USB lets existing files be copied off the drive but blocks any write, which suits evidence handling. Sherlock Forensics USB Blocker supports both modes; Group Policy and the registry method only do a full on/off block.