Data leaves an office on a pen drive and enters it inside a downloaded installer. Two Group Policies guard both doors - USB storage control and software restriction - and both fail in predictable ways when rushed.
Ask an office manager what keeps them awake and it is rarely a hacker in another country. It is the employee who copies the full client list to a pen drive on their last day, and the well-meaning colleague who installs a free PDF converter that brings three browser toolbars and a crypto miner with it. Group Policy has a specific answer for each: Removable Storage Access for the USB door and AppLocker / Software Restriction Policies for the software door. This page sets both up the way they survive contact with a real office - with exceptions planned, audit mode respected, and the disaster stories told in advance.
Deny execute alone stops most pen-drive malware; deny read and write stops data moving. Example configuration shown.
There are three honest levels. Deny execute means pen drives can carry files but nothing runs from them - this alone stops the autorun-style infection. Deny write means office data cannot be copied out, while staff can still bring files in. Deny read plus write is the full wall, right for accounts and HR machines.
Pick per department, not per emotion. A design studio that receives artwork on pen drives weekly needs a different level from the payroll desk. The setting lives at Computer Configuration - Administrative Templates - System - Removable Storage Access, and it applies to the PC, whoever signs in - which is exactly why the next section exists.
Every USB block meets the same moment: the director needs a file from a pen drive, ten minutes before a client meeting. If the only answer is policy hai, nahi hoga, the policy gets disabled forever that afternoon.
Build the door before you lock it: a second GPO, security-filtered to a small USB-Allowed group, that reverses the deny for named people or named PCs - or one designated transfer PC in the office where pen drives are allowed and scanned. Security filtering is the tool here; the separate loopback and filtering guide in this series covers its mechanics in depth. Announce the route in the same email that announces the block, and the block survives.
Honesty section. This policy controls removable storage classes. It does not stop a phone connected as a media device in every configuration, it does nothing about data leaving by email or cloud upload, and it cannot stop a camera pointed at a screen.
That is not an argument against it - it closes the fastest, bulkiest, least visible exit, and it does it free. It is an argument for calling it what it is: one layer. Pair it with the audit policy from the top-10 list and with folder redirection (files live on the server, so there is less on the PC worth copying in the first place).
Software control flips the antivirus model. Instead of listing bad programs (an endless list), you list where programs may run from: the Windows folder, Program Files, and specific approved paths. Anything in a user's Downloads or profile folders - where malware installers land - simply cannot execute.
Two engines exist. Software Restriction Policies are the older, simpler tool and still work. AppLocker is the modern one, with per-group rules and a proper audit mode - but AppLocker enforcement through Group Policy needs Windows Enterprise or Education editions. Check your edition before designing around it; plenty of offices discover this on rollout day.
AppLocker has a setting that saves careers: each rule collection can be set to Audit only. The PC logs every program that would have been blocked and blocks nothing.
Run audit mode for two to four weeks. The log will show you the office's real software: the accounting package with its oddly-placed updater, the printer utility that runs from a temp folder, the director's ancient label printer software. Add rules for the legitimate ones. Only when the audit log goes quiet do you switch to Enforce. Every enforcement horror story - the billing app dead on invoice day - is an audit mode that somebody skipped.
Enforce first on the pilot OU, with IT's own PCs included - feel your own policy before the office does. Keep the rollback one click away: the GPO link disables in seconds if something critical breaks.
Then hold the line kindly. The first week brings ye software nahi chal raha calls; each one is either a five-minute rule addition or a genuine no. Both answers build the catalogue the office actually runs on - which, six months later, becomes the most useful document IT owns.
Watch the USB block and software control policies being set live in the Top 10 GPO video, including where the exception group goes.
▶️ Watch Full VideoNo - the Removable Storage Access policies cover storage device classes only. Keyboards, mice, webcams and printers keep working. A separate family, Device Installation Restrictions, controls which hardware may install at all; that is a stronger step and not part of a standard USB block.
AppLocker rules can be created, but enforcement through Group Policy is an Enterprise and Education edition feature - on Pro the policies do not reliably enforce. Offices on Pro usually use Software Restriction Policies instead, which still work, or control software by removing local admin rights so users cannot install system-level programs.
The policy is evaluated when the device is accessed and typically takes full effect after the drive is reinserted or the PC restarts. Test with your own drives during the pilot - which is one more reason every restrictive policy starts on a test OU, not the whole office.