Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want use windows policy setting to limit access to removable media.

This can be done by setting


for limiting a specific user


for all users on the machine.

I'm looking for a method to limit all users, with the exception of one specific local user. However, the limitation appears to be additive - there is no way (that I know of) to define an exception for a specific user.

Is there some kind of alternative?

share|improve this question

This is confusing: "the limitation appears to be additive - there is no way (that I know of) to define an exception for a specific user." I am not sure what you mean because you should be able to define exceptions.

Log in as the user, and set his specific HKEY_CURRENT_USER registry entry to allow him to access USB devices by turning off the entry. If he is not an admin, this registry entry will not save, so you will have to either give him admin rights, even if only while you make the change (log out and log back in if you do make him an admin), or log in as an administrator, and find his hive under HKEY_USERS and change it there as an admin.

You will need to set all the others, who currently have profiles not to allow it.

Now, to set it for all future users, navigate to


the key structure probably ends here, so add the rest, including the "Deny_All" DWORD value. Any new users logging in, will get that setting.

share|improve this answer
disabling removable media access in the machine level (in HKEY_LOCAL MACHINE), and allowing removable media access to a specific user doesn't work. blocking each other user does work, but it's problematic with domain users (there might be many users in the domain) – Ophir Yoktan Jun 24 '11 at 20:22
@Ophir Yoktan I never said do it for it all for current each user with the appropriate permission, then set it up so any future users get the default profile, with the permission denied. – KCotreau Jun 24 '11 at 22:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .