The question every office asks a week after blocking USB - how do we, the admins, use a pen drive now? The honest answer has two halves - the policy does not spare admins, and admins hold the key that switches it off. Both halves shape the right design.
Removable storage policies are computer policies. They bind the device classes on that machine for everyone who logs in, administrators included - an admin plugging in a pen drive meets the same Access is denied as anyone else. But an admin can also open the Policy Editor and turn the block off in a minute. That is not a bug; it defines what the control really is. It fully binds standard users and merely inconveniences admins. A good office design leans into that truth instead of pretending it away.
Every conclusion on this page follows from one fact: anyone with local admin rights can undo the block. If all staff log in as administrators, your USB policy lasts exactly as long as nobody bothers to change it. The single most valuable companion setting is therefore not in the USB folder at all - it is making everyday accounts standard users, with one separate admin account held by whoever runs the PCs. With that in place, the policy becomes a real control for the people it was aimed at.
Keep one admin account for the person who maintains the PCs. When a genuine job needs USB - collecting logs, installing from media, recovering files - the ritual is short: sign in as the technician, set the policy to Not Configured, refresh with gpupdate /force, do the job, set the policy back and refresh again, and write one line in a notebook or ticket: date, PC, reason. The ritual feels slow exactly once; afterwards it is two minutes. What makes it a control is that the exception is visible, temporary and attached to a named person.
The same Removable Storage Access policies also exist under User Configuration in the Policy Editor, which means they can be aimed at users instead of the whole machine. On a shared PC you can build a per-user local policy that denies storage for the staff accounts and leaves the technician account untouched - no relaxing and re-applying at all. On a domain the equivalent is separate Group Policy objects with security filtering. This is the neatest shape for a small office with one shared machine and one maintainer.
Every office eventually hears the suggestion: just tell everyone the admin password, only for USB work. Resist it. A shared password is known by the whole office within a week, by ex-staff within a month, and it silently converts every standard user back into an admin - the USB block, the software restrictions, all of it becomes decoration. If exceptions are needed that often, the honest fix is the per-user design above, or one approved drive from the allow-list page of this guide - never a shared secret.
The truthful sentence is: the block is enforced for every standard user, and exceptions exist only through a named admin account whose use we can review. That is a strong, defensible position - it is how most real controls work. What you should never claim is that the setting makes copying impossible; the next page of this guide shows the doors that remain, and the audit page shows how to see who plugged what, which is the natural partner of an exception process.
The video covers the setting itself. Pair it with standard user accounts and the exception ritual on this page, and the setup is complete.
▶️ Watch Full VideoNo. The computer policy applies to administrators too, so your drive is refused like any other until the policy is relaxed, a per-user exception exists, or the drive is on an approved list.
There is no tick box that makes removable storage policies skip admins. The exemption is built by design - per-user policies or security filtering - not by a built in admin bypass.
Create one separate admin account, convert the daily accounts to standard users, and only then apply the USB block. Doing it in the other order produces a week of lockout complaints.