This tutorial will show you how to allow or deny write access to fixed data drives not protected by BitLocker for all users in Windows 10 and Windows 11.
BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned drives and computers. You can turn on BitLocker protection for operating system drives, fixed data drives, and removable data drives.
You can use the Deny write access to fixed drives not protected by BitLocker policy setting to require encryption of fixed drives prior to granting write access.
If you enable this policy setting, all fixed data drives that are not BitLocker-protected will be mounted as read-only with "This disk is write-protected". If the drive is protected by BitLocker, it will be mounted with read and write access.
If you disable or don't configure this policy setting, all fixed data drives on the computer will be mounted with read and write access.
You must be signed in as an administrator to be able to allow or deny write access to fixed data drives not protected by BitLocker.
Contents
- Option One: Allow or Deny Write Access to Fixed Data Drives not Protected by BitLocker in Local Group Policy Editor
- Option Two: Allow or Deny Write Access to Fixed Data Drives not Protected by BitLocker using REG file
EXAMPLE: Deny write access to fixed data drives not protected by BitLocker
Allow or Deny Write Access to Fixed Data Drives not Protected by BitLocker in Local Group Policy Editor
The Local Group Policy Editor is only available in the Windows 10/11 Pro, Enterprise, and Education editions.
All editions can use Option Two to configure the same policy.
1 Open the all users, specific users or groups, or all users except administrators Local Group Policy Editor for how you want this policy applied.
2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Fixed Data Drives
3 In the right pane of Fixed Data Drives in the Local Group Policy Editor, double click/tap on the Deny write access to fixed drives not protected by BitLocker policy to edit it. (see screenshot above)
4 Do step 5 (allow) or step 6 (deny) below for what you want.
5 Allow Write Access to Fixed Data Drives not Protected by BitLocker
This is the default setting.
A) Select (dot) Not Configured. (see screenshot below)
B) Click/tap on OK, and go to step 7.
6 Deny Write Access to Fixed Data Drives not Protected by BitLocker
A) Select (dot) Enabled. (see screenshot below)
B) Click/tap on OK, and go to step 7.
7 Close the Local Group Policy Editor.
8 Restart the computer to apply.
Allow or Deny Write Access to Fixed Data Drives not Protected by BitLocker using REG file
1 Do step 2 (allow) or step 3 (deny) below for what you want.
2 Allow Write Access to Fixed Data Drives not Protected by BitLocker
This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Allow_write_access_to_fixed_data_drives_not_protected_by_BitLocker.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE]
"FDVDenyWriteAccess"=-3 Deny Write Access to Fixed Data Drives not Protected by BitLocker
A) Click/tap on the Download button below to download the file below, and go to step 4 below.
Deny_write_access_to_fixed_data_drives_not_protected_by_BitLocker.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE]
"FDVDenyWriteAccess"=dword:000000014 Save the REG file to your desktop.
5 Double click/tap on the downloaded REG file to merge it.
6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
7 Restart the computer to apply.
8 You can now delete the downloaded REG file if you like.
That's it,
Shawn Brink
Last edited:
