Any pen drive that fits the port can copy your files out or carry a virus in. Windows already ships the lock - Group Policy settings inside Windows can deny read and write access to USB storage, with no third party tool and no cost.
This is the method from the video: no tools, no downloads, only settings that are already inside Windows. An open USB port accepts every drive anyone plugs in - a visitor, a customer, a staff member with a personal pen drive. Two built in routes close that door. The Group Policy Editor route works on Windows Pro, Enterprise and Education. The registry route writes exactly the same policy values and works on every edition, including Home. Pick your route below, test it with your own drive, and only then call it done.
There are three honest levels, and they are not the same. Deny write only lets people open files from a drive but stops anything being copied onto it. Deny read plus write makes the drive completely unusable for data - the strongest setting, and the one this guide builds. Deny all removable storage classes additionally covers CD and DVD drives, tape drives and phones in storage mode. Most offices and shops want the second level. Home users should read the last page of this guide first - for a single user PC the block is often not worth it.
gpedit.msc and press EnterComputer Configuration → Administrative Templates → System → Removable Storage Accessgpupdate /force so the policy applies at onceA drive that is already plugged in can keep working until it is removed and plugged in again - the check happens when a device connects. So unplug your test pen drive, plug it back in, and open it. The correct result: the drive letter appears, but opening it shows Access is denied and copying anything onto it fails. If your own drive still opens normally, the policy has not refreshed yet - run gpupdate /force once more and retest. Never roll this out to every PC in an office on the strength of the settings screen alone.
Windows Home has no Policy Editor, but the policy itself is only registry values, and you can write them by hand. First create a restore point. Then open Registry Editor and go to HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} - create the keys if they do not exist. Inside, create two DWORD (32-bit) values: Deny_Read set to 1 and Deny_Write set to 1. Sign out and back in, then test with a drive exactly as above. This is the identical footprint Group Policy leaves, which is why it behaves the same way. To undo it later, set both values to 0 or delete them.
The classic trick is the USB storage driver switch: in the registry at HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR, set Start to 4 and restart. The mass storage driver then never starts, so no USB drive appears at all. It works, but it is cruder than policy - it hits every kind of USB storage with no read-versus-write choice and no exceptions - so treat it as a fallback for a single stubborn PC, not the main method. Setting Start back to 3 and restarting restores normal behaviour.
Your USB keyboard, mouse, printer, webcam and headphones are not storage devices - they belong to different device classes and these policies never touch them. The one honest gap: a phone connected in file transfer mode presents itself as a portable media device (the WPD class), not as a removable disk, so the Removable Disks settings alone may not cover it. The All Removable Storage classes policy, or the separate WPD Deny settings in the same policy folder, close that gap. Nothing here needs a paid tool.
Nothing in this guide is permanent. In the Policy Editor, set the same policies back to Not Configured and run gpupdate /force. In the registry route, set the Deny values to 0 or delete the key you created. Drives work again on the next plug-in. That reversibility is exactly why the built in route beats random USB blocker utilities downloaded from the internet - you always know precisely what was changed and how to change it back.
The full walkthrough from the video - Policy Editor open, setting enabled, drive plugged in and refused - in under three minutes.
▶️ Watch Full VideoNo. Windows Pro, Enterprise and Education have the Group Policy Editor built in, and every other edition - including Home - accepts the same policy values through the registry. No download is involved anywhere in this method.
No. These policies only cover storage device classes such as removable disks. Keyboards, mice, printers, webcams and audio devices are different classes and keep working normally.
The check happens when a device connects. A drive that was inserted before the policy applied can keep working until it is removed. Unplug it, plug it back in, and it will be refused.