{
	"id": "5df194dd-317b-4b48-9dc2-12259f365e2d",
	"created_at": "2026-04-06T00:22:33.883966Z",
	"updated_at": "2026-04-10T03:21:06.066231Z",
	"deleted_at": null,
	"sha1_hash": "e8fd5cd4e657c012413aeff6e9f69e16dfcfb296",
	"title": "Deny All Access to Removable Devices or Media",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43711,
	"plain_text": "Deny All Access to Removable Devices or Media\r\nBy Archiveddocs\r\nArchived: 2026-04-02 12:32:42 UTC\r\nApplies To: Windows Server 2008\r\nYou can use this procedure to restrict the ability of your users to both read and write to or from any removable\r\ndevice that falls into the following categories:\r\nCD and DVD drives. This type of drive uses removable media.\r\nFloppy disk drives. This type of drive uses removable media.\r\nRemovable drives. This type of drive is an external drive connected to the computer using a USB or IEEE\r\n1394 connection. It includes both hard disk drives and flash memory drives.\r\nTape drives. This type of drive uses removable media.\r\nWindows Portable Devices. This type of device includes media players, smart phones, and so on.\r\nMembership in the local Administrators group, or equivalent, is the minimum required to complete this\r\nprocedure.\r\nTo deny all access to removable devices\r\n1. Open the Group Policy Management Editor. To do so, click Start, and then in the Start Search box, type\r\nmmc gpedit.msc .\r\n2. In the navigation pane, open Local Computer Policy. Then do one of the following:\r\nIf you want the policy to affect all users on the computer, open Computer Configuration in the\r\nnavigation pane.\r\nIf you want the policy to affect only the currently logged on user, open User Configuration in the\r\nnavigation pane.\r\n3. Continue by opening the following folders: Administrative Templates, System, and Removable Storage\r\nAccess.\r\n4. In the details pane, double-click All Removable Storage classes: Deny all access.\r\n5. Click Enabled.\r\n6. Click OK to save your changes.\r\nhttps://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx\r\nPage 1 of 2\n\nAdditional considerations\r\nIf the device to which you wish to prevent access is not covered by any of the other categories, you can\r\ndeny read and/or write access to devices that have a specified device setup class GUID. See the second\r\nprocedure in Control Read or Write Access to Removable Devices or Media to create a list of device setup\r\nclass GUIDs for devices that you do not want users to read to or write from.\r\nIf a device affected by this policy is currently in use, you might have to restart the computer to enforce the\r\npolicy immediately. See Force a Restart to Ensure Removable Storage Access Policy is Enforced.\r\nIf you edit policy settings locally on a computer, you will affect the settings on only that one computer. If\r\nyou configure the settings in a Group Policy object (GPO) hosted in an Active Directory domain, then the\r\nsettings apply to all computers that are subject to that GPO. For more information about Group Policy in an\r\nActive Directory domain, see Group Policy (https://go.microsoft.com/fwlink/?LinkId=55625).\r\nMake sure to test all applications required by the users that will be affected by this policy setting to ensure\r\nthat you do not prevent applications required by the user from working properly.\r\nSource: https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx\r\nhttps://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/cc772540(v=ws.10).aspx"
	],
	"report_names": [
		"cc772540(v=ws.10).aspx"
	],
	"threat_actors": [],
	"ts_created_at": 1775434953,
	"ts_updated_at": 1775791266,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e8fd5cd4e657c012413aeff6e9f69e16dfcfb296.pdf",
		"text": "https://archive.orkl.eu/e8fd5cd4e657c012413aeff6e9f69e16dfcfb296.txt",
		"img": "https://archive.orkl.eu/e8fd5cd4e657c012413aeff6e9f69e16dfcfb296.jpg"
	}
}