The fear that stops most people from blocking USB is simple - if I block USB, my keyboard dies too. It does not. Windows sorts every device into classes, and the blocking settings only speak to the storage classes.
A USB port is just a socket. What matters is what kind of device Windows decides is on the other end of the cable. A pen drive announces itself as storage. A keyboard announces itself as an input device. A printer is a printer. The policies in this guide family deny access per device class, which is why you can slam the storage door shut while every other device on the same port keeps working. Understanding the classes also shows you the two traps: phones that are not disks, and one blunt setting that really would kill a keyboard.
When any USB device connects, it tells Windows its device class, and Windows applies rules by class. The Removable Storage Access policy family covers exactly these: Removable Disks, CD and DVD drives, Floppy drives, Tape drives and WPD devices (portable media players and phones in media mode). Nothing outside that list is affected by these policies - there is no setting inside this family that can block a keyboard even by accident.
Pen drives, external hard disks, memory card readers and any drive Windows mounts with a letter are Removable Disks - fully covered by Deny read and Deny write. CD and DVD drives and tape drives have their own Deny settings in the same folder if your office still uses them. Set the classes you actually worry about; there is no prize for blocking a floppy drive in 2026.
Keyboards and mice belong to the human interface device class. Printers are the printer class. Webcams, USB headphones, barcode scanners and signature pads each sit in their own classes too. None of these are storage, so none of them are affected. After applying the block, test them anyway - it takes ten seconds and it is the proof your staff will ask for before they believe you.
A modern phone connected by cable usually presents itself in file transfer (MTP) mode as a WPD device, not as a removable disk. That means the Removable Disks settings alone may leave phone transfers open. Two built in fixes exist: enable All Removable Storage classes: Deny all access, which sweeps WPD in with everything else, or set the WPD Devices: Deny read access and Deny write access policies in the same Removable Storage Access folder. A phone locked to charging-only mode transfers nothing at all.
There is a second, blunter family - Device Installation Restrictions - which can stop a device from being installed at all. If you ever use it, aim it at the disk drive setup class only: {4d36e967-e325-11ce-bfc1-08002be10318}. Never block the USB controller class {36fc9e60-c465-11cf-8056-444553540000} - that class is the port hardware itself, and blocking it really can take keyboards, mice and everything else USB down with it. For almost everyone, the storage access policies from the core guide are the right tool; installation restrictions are for the approved-drive setup described in another page of this guide.
The video applies the built in block and shows exactly which devices are hit - watch it before you roll this out on office PCs.
▶️ Watch Full VideoWindows policies work by device class, not by physical port, so the built in settings cannot single out one socket. Port-level control needs BIOS options or hardware port blockers, which also affect keyboards on those ports.
Yes, if it presents itself as a keyboard-style input device, which most do. A card reader that mounts storage cards is different - the card slot is a removable disk and will be blocked, so test your exact reader.
No. Charging draws power only and keeps working. What the WPD policies stop is file transfer with the phone, not the charging itself.