A full USB ban breaks real work - visitors bring files, staff print from pen drives. The middle way lets every drive be read but refuses to write a single file onto it, so data can come in and cannot walk out on a pocket drive.
Most offices do not actually need a total ban. They need one direction stopped: files leaving the building on a pen drive. Files arriving - a quotation from a supplier, photos from a site visit, a print job - are normal work. Windows policy separates the two directions cleanly. You enable only the write denial, leave reading open, and add the execute denial so nothing can run straight off a drive either. This page is that setup, plus the honest account of what it does not stop.
gpedit.msc and go to Computer Configuration → Administrative Templates → System → Removable Storage Accessgpupdate /force, then unplug and replug a test driveOn Windows Home the same result comes from the registry key HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} with only Deny_Write (and optionally Deny_Execute) set to 1.
They plug in a drive and everything looks normal. They can open documents, view photos, print files and copy files from the drive onto the PC. The moment anyone tries to save, drag or copy a file onto the drive, Windows refuses with an access denied error. That user experience matters: nobody feels locked out of their work, but the pocket copy-out route is closed. Announce the change before you enable it, so the first refusal is not a surprise helpdesk call.
Reading is open, and that means an infected drive can still bring files in. A write block is not an antivirus. Keep Microsoft Defender's scanning on, let it scan removable drives, and never let staff run programs from unknown media - the execute denial above already makes that hard by design. If your real fear is malware arriving, the full deny from the core guide, or the BitLocker To Go approach on another page of this guide, fits better than this middle way.
Be clear about what write denial proves. It stops copying onto USB storage. It does not stop a person emailing a file to themselves, uploading it to a personal cloud account, or photographing the screen. If your office policy is about casual mistakes and easy temptation, the write block is exactly the right strength. If it is about a determined insider, no single setting is the answer - you need the layered picture described in the determined-user page of this guide.
To audit a PC, reopen the same policy page or read the registry values - a Deny_Write of 1 under the removable disks key means the block is live. To undo, set the policy back to Not Configured, or the value to 0, refresh policy and replug the drive. Keep a one line note of which PCs run the middle way and which run the full ban; mixed fleets confuse everyone during the next incident.
The video shows the built in Windows route for stopping unauthorised USB access - the write-only version is one checkbox different.
▶️ Watch Full VideoYes. Printing reads the file, and reading is allowed. The print happens normally; only saving or copying files onto the drive is refused.
Yes. Formatting is a write operation, so a protected drive cannot be formatted or have files deleted while the policy is active.
The Removable Storage Access policies also exist under User Configuration in the Policy Editor, so on a shared PC you can apply the write denial to specific users instead of the whole machine.