Privacy and Security Deny Write Access to Removable Drives not Protected by BitLocker in Windows 11

This tutorial will show you how to allow or deny write access to removable drives not protected by BitLocker for all users in Windows 10 and Windows 11.

BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned drives and computers. You can turn on BitLocker protection for operating system drives, fixed data drives, and removable data drives.

You can use the Deny write access to removable drives not protected by BitLocker policy setting to configure whether BitLocker protection is required for a device to be able to write data to a removable data drive.

If you enable this policy setting:

• All removable data drives that are not BitLocker-protected are mounted as read-only with "This disk is write-protected".
• If the drive is protected by BitLocker, it's mounted with read and write access.
• If the Do not allow write access to devices configured in another organization option is selected, only drives with identification fields matching the computer's identification fields are given write access.
  • When a removable data drive is accessed, it's checked for valid identification field and allowed identification fields. These fields are defined by the (Provide the unique identifiers for your organization) policy setting.

If you disable or do not configure this policy setting, all removable data drives on the computer are mounted with read and write access.

You must be signed in as an administrator to allow or deny write access to removable drives not protected by BitLocker.

This Deny write access to removable drives not protected by BitLocker policy setting is ignored if the policy settings Removable Disks: Deny write access is enabled.

EXAMPLE: Deny write access to removable drives not protected by BitLocker

The Local Group Policy Editor is only available in the Windows 10/11 Pro, Enterprise, and Education editions.

All editions can use Option Two to configure the same policy.

1 Open the all users, specific users or groups, or all users except administrators Local Group Policy Editor for how you want this policy applied.

2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)



3 In the right pane of Removable Data Drives in the Local Group Policy Editor, double click/tap on the Deny write access to removable drives not protected by BitLocker policy to edit it. (see screenshot above)

4 Do step 5 (allow) or step 6 (deny) below for what you want.

This is the default setting.

7 You can now close the Local Group Policy Editor if you like.





1 Do step 2 (allow), step 3 (deny), or step 4 (deny also from another organization) below for what you want.

This is the default setting.

(Contents of REG file for reference)





(Contents of REG file for reference)

This is for the Do not allow write access to devices configured in another organization option that only drives with identification fields matching the computer's identification fields will be given write access. When a removable data drive is accessed it will be checked for valid identification field and allowed identification fields. These fields are defined by the Provide the unique identifiers for your organization policy setting located at Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption in the Local Group Policy Editor.

(Contents of REG file for reference)

5 Save the REG file to your desktop.

6 Double click/tap on the downloaded REG file to merge it.

7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

8 You can now delete the downloaded REG file if you like.


That's it,
Shawn Brink