Total bans fail in offices that genuinely move files on one trusted pen drive. Windows can work the other way round - refuse every storage device except the specific drives on your approved list, identified by their own device identity.
Instead of a ban with holes poked in it, build an allow list: named drives may be used, everything else is refused at installation. Windows does this with the Device Installation Restrictions policies. The catch that decides whether your list means anything is which identity you write down - the model identity that a thousand drives share, or the instance identity that belongs to one physical drive. This page walks the setup and says plainly where the loose edges are.
gpedit.msc and go to Computer Configuration → Administrative Templates → System → Device Installation → Device Installation Restrictionsgpupdate /force and test with an unlisted drive first - it should fail to install - then with the approved oneThe neighbouring Hardware Ids entry names only the model. Every drive of that model matches it - useful if you approve a model, useless if you approve one physical drive.
The instance path is only as unique as the serial number inside it. Quality brands burn a genuine unique serial into every unit. Very cheap unbranded drives often report a fake or repeated serial - two different drives can present the same identity, and your one-drive list quietly becomes a two-drive list. Buy approved drives from a real brand, write each serial in a small register with its owner and issue date, and treat a lost approved drive as a list change the same day, not next month.
Installation policies judge a device when it installs. A drive that was used on the PC before you set the list may already be installed and keep working. When you first roll this out, clear the slate: in Device Manager, uninstall the existing USB storage devices (they reinstall on next plug-in and get judged by the new rules), then test every behaviour again. After that one-time clean-up, the list is enforced for every new arrival.
If managing a serial list sounds fragile for your office, the other built in answer is the BitLocker To Go setup covered in its own page of this guide: any drive may be read, but writing is allowed only to drives encrypted under your organisation. The trust anchor becomes a key instead of a serial number, and a lost drive is a password problem rather than a list problem. Many offices end up preferring it.
The video shows the no-tools Windows approach to USB access control - the approved-drive setup builds directly on it.
▶️ Watch Full VideoNormally yes - the policies are standard settings and persist across updates. Still, after a major update, test once with an unlisted drive and once with the approved one before assuming the list is still enforced.
Yes. The allow policy accepts a list of device IDs, so every approved drive can be added. Keep the register updated each time you add one.
It may keep working because it was already installed, and so may other old drives. Uninstall existing USB storage devices in Device Manager once, so every drive is judged by the list on its next plug-in.