Disable USB Storage Using Group Policy in Windows XP

In Windows XP environments, preventing unauthorized data exfiltration and malware infection required system administrators to block USB removable storage devices across domain-joined machines. Because Windows XP lacked the native, plug-and-play removable storage Group Policy settings introduced in later versions like Windows Vista, administrators had to rely on custom Administrative Templates (.adm files) to modify system registry keys, or use Group Policy file system security settings to restrict access to core USB driver files.

Method 1: Deploying a Custom ADM Template to Alter the Registry

The primary method for disabling already installed USB mass storage devices was modifying the Windows registry key responsible for the USB storage driver service. Windows XP set the startup type for this service to automatic or on-demand by default.

To automate this via Group Policy, administrators created and imported a custom .adm template into the Group Policy Object Editor:

  1. Creating the Template: Administrators wrote a plain text file saved with a .adm extension that targeted the HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR registry key, specifically the Start DWORD value.
  2. Importing the ADM File: In the Group Policy Management Console (GPMC) or Local Group Policy Editor, administrators navigated to Computer Configuration > Administrative Templates, right-clicked to select Add/Remove Templates, and loaded the custom file.
  3. Configuring the Policy:
    • Setting the Start value to 4 disabled the USB storage driver entirely.
    • Setting the Start value to 3 restored normal functionality.
  4. Deploying to Organizational Units (OUs): The GPO was linked to specific computer OUs, disabling the USB driver service upon the next policy refresh (gpupdate /force).

Method 2: Restricting Driver File Permissions via Group Policy

Modifying the registry only affected USB storage devices that had already been plugged into the machine at least once. If a user plugged in a brand-new device, Windows XP would attempt to reinstall the driver using the local setup files. To prevent this, administrators restricted permissions to the installation files using Group Policy File System security.

Administrators configured these settings using the following path: Computer Configuration > Windows Settings > Security Settings > File System

From there, administrators added and locked down two specific system files:

  • %SystemRoot%\Inf\Usbstor.pnf
  • %SystemRoot%\Inf\Usbstor.sys

To completely prevent the driver from loading for standard users while allowing system operations:

  1. Administrators added the files to the policy and removed inherited permissions.
  2. The user group or account (such as Users or Everyone) was assigned an explicit Deny permission for Read, Write, and Execute.
  3. Alternatively, administrators removed user access while granting Full Control only to SYSTEM and local Administrators, preventing standard domain users from triggering the driver installation process when a new device was inserted.

The Combined Implementation

To achieve a total lockdown, administrators typically deployed both methods simultaneously. The custom ADM template set the USBSTOR registry key to 4 to shut down access for previously connected drives, while the File System security policy blocked Windows XP from staging or installing drivers for any newly introduced USB storage hardware.