Q. How can I set USB devices to read-only via Group Policy?

A. In a previous FAQ, I talked about setting USB devices to read-only by setting the registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlStorageDevicePoliciesWriteProtect to 1. To set from Group Policy, you need to create a custom administrative template file. Below is a template file in the ADM format.

CLASS MACHINECATEGORY "USB Storage Devices"POLICY "Write Protect USB Storage"KEYNAME "SYSTEMCurrentControlSetControlStorageDevicePolicies"VALUENAME "WriteProtect"VALUEON NUMERIC 1VALUEOFF NUMERIC 0END POLICYEND CATEGORY

Import the policy into a Group Policy Object (GPO) and you will be able to configure the setting as the Figure shows. To view, make sure you don't have Filter On enabled in Windows Server 2008 or disable the "Only show policy settings that can be fully managed" option in pre-2008 GPO editors.