Forum FAQ: How to restrict mass storage drive and CD-ROM access? RRS feed

  • General discussion

  • Question


    How to restrict mass storage drive and CD-ROM access?



    For Windows 2000, Windows XP and Windows Server 2003 computer, there is no build-in group policy to disable access to mass storage drive and CD-ROM. You can refer to the following Microsoft Knowledge Base articles to block USB storage device installation or usage:


    How to disable the use of USB storage devices

    HOWTO: Use Group Policy to disable USB, CD-ROM, Floppy Disk and LS-120 drivers


    For Vista and later version of Windows client, you can simply configure the following group policies to control the access:


    [Computer Configuration\Administrative Templates\System\Removable Storage Access]

    CD and DVD: Deny read access

    CD and DVD: Deny write access

    Removable Disks: Deny read access

    Removable Disks: Deny write access

    All Removable Storage classes: Deny all access

    All Removable Storage classes: allow direct access in remote sessions


    Applies to


    Windows Server 2000; Windows Server 2003

    Windows Vista; Windows 7; Windows Server 2008; Windows Server 2008 R2

    Monday, February 22, 2010 7:22 AM

All replies

  • I have a problem when I try to apply the group policy in members servers with Windows 2008 R2, the policy works perfectly in Windows 7 clients, but when I use the Policy (Administrative Templates > System,> Removable Storage Access > User Configuration) it doesn´t work. I need to use it with User Configuration, because I need to give permission to some users, that have administrative permissions; I try with Computer Configuration, and it works, but this configuration doesn´t work for my environment.

    Does anyone could solve this issue? I try with several options that I found, and I continue with the problem.

    Wednesday, February 18, 2015 9:26 PM
  • Hello, my Domain Controller GPO (Win2008R2 server with Win2008 Functional Level) does not have the path "Computer Configuration\Administrative Templates\System\".  How can we proceed?
    Thursday, May 19, 2016 7:27 PM