Take the 2-minute tour ×

I need to forbid all users except administrators to write into DVD/CD/USB drives on Windows XP.

Googled around and there is a way to disable devices completely:


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom\Start (from 1 to 4)


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Start (from 3 to 4)

but I need to disable them only for particular users.

share|improve this question
add comment

2 Answers

At work we use a product called Sancturary which can do this sort of thing. I have no idea how much it costs, I'm sure there are other products available as well.

share|improve this answer
Thank you for this information. –  alex2k8 Mar 14 '10 at 1:03
add comment

Check out this article for disabling access using group policy: http://windowsdevcenter.com/pub/a/windows/2005/11/15/disabling-usb-storage-with-group-policy.html

share|improve this answer
Thank you for this article. But thought the custom template for group policy is a more elegant solution, it still does the same registry keys editing. As so will disable devices for all users. –  alex2k8 Mar 15 '10 at 1:35
I assumed, apparently incorrectly, that since you were posting on ServerFault that the computers in question were part of an Active Directory domain, in which case the group policy could be assigned per user. –  emgee Mar 15 '10 at 16:46
add comment

Your Answer


