Block USB Storage Devices (Flash Drives) via Registry

Stop Windows from mounting USB flash drives and external disks by disabling the USBSTOR service.

WindowsregistryusbsecurityMedium risk

Run `reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f` as administrator and restart the PC.

01Command

Command

$ reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f

02What it does

Setting the USBSTOR service Start value to 4 (Disabled) makes Windows ignore mass-storage devices — plugging in a flash drive or external hard disk simply does nothing, while keyboards, mice, and other USB gear keep working. This is a common lockdown for shared or front-desk PCs where people shouldn't copy files to or from a stick. Setting the value back to 3 (Manual/On demand) restores normal behavior.

03Risk

RiskMedium risk

Requirements需要管理员权限；重启后生效；只影响 USB 存储设备，不影响鼠标键盘。

!Warning: Already-plugged devices can still appear until you restart, and a determined user with admin rights can undo this. On modern Windows you may also enforce this centrally with the Storage CSP (RemovableDiskDenyRead/Write) if you manage devices.

04Undo

Undo

$ reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 3 /f

05Sources

Policy CSP - Storage | Microsoft Learn
Microsoft · vendor-doc · 2026-09-17
Evidence: Documents Microsoft's storage policies such as RemovableDiskDenyRead/Write used to block USB storage access on Windows.
REG - Add, modify and delete registry entries
SS64 · community · 2026-09-17
Evidence: Documents the reg add command syntax for changing registry values such as the USBSTOR service Start value.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy

WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17

Take ownership of a file or folder with takeown and icacls

WindowsFilessystemsecurity

Two-step command sequence that makes you the owner of a locked file tree and grants yourself full control — the standard fix for 'Access is denied' on old profiles and OS reinstall leftovers.

High risk ✓ 2026-09-17

Verify File Hashes with certutil -hashfile

Windowshashcmdsecurity

Built-in Windows command to compute MD5, SHA1 or SHA-256 hashes of any file.

Low risk ✓ 2026-09-17