8 Ways To Write Protect or Deny Access to USB Drives

5. Wenovo USB Disks Access Manager

USB Disks Access Manager is the simplest tool here to use with a single window and three options to choose from. By default the system will have both read and write access, this can be changed to read only preventing any data from being written. Or you can select disable to stop the device from showing up in Explorer by disabling the USB storage driver.

Wenovo usb disks access manager

After the selection has been made press Apply and (re)insert any USB storage devices for the changes to take effect. Even though the program downloads with the word “setup” in its filename, it is actually a portable executable.

Download Wenovo USB Disks Access Manager


6. USB Flash Drives Control

This small piece of software is from developer Binisoft, which is now owned by security company Malwarebytes. The idea of USB Flash Drives Control is to be a more permanent solution that is always running because it installs as a system service and is controlled entirely from its tray icon context menu.

Usb flash drives control

After install, you have three main options from the tray icon menu that are basically the same as the tools above. The first is Read Mode, disable it and USB drives will be unavailable on the system. Uncheck the Write Mode option to make all inserted USB drives read only. Turning off Execute Mode will stop any executable files from being launch on removable drives. As usual, changes take effect the next time the drive is inserted.

During uninstall, USB Flash Drives Control offers to reset the settings in the registry back to the system defaults. This is useful if you have been using any of these options here and just want to put the system back to the default settings.

Download USB Flash Drives Control


7. Disable USB Access Or Write Protect Drives By Editing The Registry

For the most part, the tools above disable or enable USB device write access through the system registry and one simple value change. Complete denial of access to the USB device is also another change to a different value.

We won’t cover manually editing the registry to write protect a USB drive here as it’s covered in another article. If you would like to know how to do it, read the article and the section on editing the registry yourself to enable write protection. Alternatively, download the ready made .REG files from below.

Download DisableUSBWrite.reg

Download EnableUSBWrite.reg

We’ve also covered how to disable removable storage devices such as USB drives by editing the registry elsewhere. Remember, attached USB storage devices will have to be reinserted for the changes to be applied. Download the .REG files from below.

Download DisableUSBMassStorage.reg

Download EnableUSBMassStorage.reg

Just download the file you want and double click it to import the data into your registry. Obviously, these are more manual options to a more friendly user interface but they do the same job in the background.


8. Write Protect A Single USB Device

The disadvantage the methods above have is the changes affect all devices attached to the system. All USB flash drives, memory cards, or hard drives will be write protected until the setting is changed to full access. This solution write protects only those drives you want on the local system, other systems will still have full access.

1. Open an admin Command Prompt (press Ctrl+Shift+Enter after typing cmd into Start) and type Diskpart.

2. Type List Disk to see the list of attached disks. Find the number corresponding to the USB storage device you want to write protect and enter Select Disk #.

Diskpart select disk

3. Type Attributes disk set readonly, to confirm read only has been set you can optionally type attributes disk. If Read-only says Yes then it was successful and your drive is write protected on next insert.

Diskpart set readonly

4. Type Exit and close the Command Prompt. To disable write protect for that drive enter Attributes disk clear readonly at step 3 instead.

This method is not a secure solution because the ID given to the device in the registry differs depending on which USB port it’s plugged into. Use another port and a new ID with a new write protect value will be created allowing full access. An obvious but inefficient workaround is attaching the drive to all available USB ports in turn and setting the write protect flag for each.

Tip: It’s possible to write protect a specific drive without using Diskpart and optionally create a .REG file to quickly turn the setting on or off. You do need to know the hardware name for the drive but it should be easy enough to work out from the list of USB devices. Go to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

Find the drive name in question from the list and expand it to reveal a key with a unique ID, expand that also. Then go to Device Parameters > Partmgr. Changing the Attributes Value from 0 to 2 will make the drive read only on that specific USB port.

Partmgr registry export

Right click on Partmgr and export the key with the Attributes value set to 0 and then 2. That will allow you to quickly click on either to change the status of the drive. Multiple unique IDs inside the device name key means it has been inserted into multiple USB ports and each one represents a different port. Change the Attributes value for each to protect the device in all used ports.

9 Comments - Write a Comment

  1. Shawn 7 months ago
    • HAL9000 7 months ago
  2. Brenda Monaghan 10 months ago
  3. printland 1 year ago
  4. David 1 year ago
  5. HAL9000 2 years ago
  6. Eddie J. Bush 2 years ago
  7. Justchillman 9 years ago
  8. newbie 9 years ago

Leave a Reply

Your email address will not be published. Required fields are marked *

Note: Your comment is subject to approval. Read our Terms of Use. If you are seeking additional information on this article, please contact us directly.