Instead of banning drives, change what a drive must prove before it may be written to. BitLocker To Go policy makes every unprotected removable drive read only, while your own encrypted office drives work normally - data arrives freely and leaves only on sealed drives.
A ban is a wall; this is a filter. With one built in policy, Windows allows any removable drive to be opened and read, but writing is permitted only to drives protected by BitLocker. A supplier's pen drive still delivers its quotation. A staff member's random stick still cannot take files away - unless it is one of your encrypted drives, whose contents are sealed even if it is lost on a bus. For many offices this softer shape survives contact with real work far better than a total ban, and it is the approach this page sets up.
gpedit.msc and go to Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Removable Data Drivesgpupdate /force, then test: an ordinary pen drive should open for reading but refuse every copy onto itFrom that moment, the path to a writable drive runs through BitLocker: right-click the drive in Explorer, choose Turn on BitLocker, set a strong password, and - this matters - save the recovery key somewhere central before the drive is used.
Reading is untouched, so incoming files flow as before. Each office drive is encrypted once - a one-time wait, longer on big slow drives - and from then on it asks for its password when plugged into a fresh PC and behaves like any drive. Staff stop carrying random sticks because random sticks cannot be written to; the drawer of identical office drives becomes the habit. That behaviour change, not the cryptography, is most of the win.
Read the default policy carefully: it asks only whether the drive is protected by BitLocker - including a drive a visitor encrypted at home with their own password, which would then be writable on your PCs. The same policy folder carries the fix: configure the organisation identification fields for your company and enable Deny write access to devices configured in another organization. Now only drives sealed under your organisation count as writable. Skip this card and the control has a polite, well-dressed hole in it.
BitLocker exists only on Pro, Enterprise and Education editions - Windows Home cannot run this scheme at all. Encryption takes real time on large drives. And the discipline is unforgiving: a forgotten password plus a lost recovery key means the data is gone - that is the product working as designed. Keep a recovery key register (a file on the server, or keys stored in Active Directory where available), test an unlock on a second PC before the drive matters, and never let the only copy of anything live on one removable drive, encrypted or not.
Choose the full ban (core guide) when drives should simply never be used - billing counters, exam rooms, shared kiosk PCs. Choose the BitLocker filter when file movement on drives is real work - field staff, site engineers, accounts moving data between offices. Choose the write-only middle way (another page in this guide) when you lack Pro editions and still want the copy-out road closed. All three are built in; the honest pick depends on the work, not on which setting sounds toughest.
The video covers the built in Windows route to stopping unauthorised USB access - BitLocker To Go is the softer sibling setting in the same toolbox.
▶️ Watch Full VideoIt can be unlocked and read with the password, because reading support is built into Windows. But Home cannot encrypt new drives or enforce the write policy - the enforcing PCs need Pro or above.
Unlock with the 48 digit recovery key you saved when the drive was encrypted. Without the password or the key, the contents cannot be recovered - by design.
It stops writing to any drive except your organisation's encrypted ones. Combined with the other-roads honesty from this guide - email and uploads are separate controls - it closes the USB copy-out road properly.