What This Policy Does

The policy "Deny write access to removable drives not protected by BitLocker" prevents Windows from allowing any write operations to a USB flash drive, external hard disk, or SD card unless that device has been encrypted with BitLocker To Go. Read access can be permitted or denied separately.

When this policy is enabled and a user inserts an unencrypted USB drive, they see a notification: "This drive is write-protected. To save files to this drive, you'll need to use BitLocker." The drive mounts as read-only, and Windows Explorer shows the drive with a lock icon.

This is a meaningful data-loss prevention (DLP) control. It stops staff from copying sensitive data to unencrypted USB drives that could be lost or stolen. Combined with BitLocker on the endpoint itself, it closes a significant data exfiltration path without requiring a third-party DLP product.

Where to Find the Policy

Open Group Policy Management Editor and navigate to:

Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives

The relevant settings in this container are:

Policy SettingWhat It Does
Deny write access to removable drives not protected by BitLockerThe primary setting. Prevents write access to unencrypted removable drives. Includes an option to also deny write access to drives from other organisations.
Control use of BitLocker on removable drivesAllows or prevents users from applying BitLocker To Go themselves. Useful to allow self-service encryption when the write-deny policy is active.
Choose how BitLocker-protected removable drives can be recoveredConfigures recovery options — password, smart card, or automatic unlock — for BitLocker To Go drives.
Configure use of passwords for removable data drivesSets password complexity requirements for BitLocker To Go password-based encryption (minimum length, complexity).

Deny Write vs Require Encryption — The Key Distinction

Deny write access is a reactive control: the drive can still be read, users just cannot write to it unless it is encrypted. This is the most common and practical deployment because it allows staff to read reference material from an unencrypted USB without completely blocking workflows.

Require encryption before access is not a single setting — it is the combination of deny write access plus configuring Control use of BitLocker on removable drives so that users are prompted to encrypt the drive on insertion. This is a stricter posture appropriate for regulated environments (health, legal, financial services).

ℹ️The "Deny write access" policy has a sub-option: "Do not allow write access to devices configured in another organization." This uses the BitLocker identification field embedded in the drive. If your organisation sets a BitLocker Identification Field (via GPO), drives encrypted by a different organisation are treated as unprotected. Useful for preventing contractors from copying data to their own encrypted drives.

Allowing Read-Only Access to Unprotected Drives

When you enable "Deny write access to removable drives not protected by BitLocker," Windows automatically allows read access to unprotected drives unless you take additional steps to block that too. This is the recommended configuration for most organisations — staff can read from USB drives but cannot copy data to them.

To verify the policy is applying read-only access (not a full block), check the registry after GPO applies:

# Read-only for unprotected drives = RDVDenyWriteAccess is 1, RDVDenyCrossOrg may be 0 or 1 Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\FVE" | Select-Object RDVDenyWriteAccess, RDVDenyCrossOrg

If RDVDenyWriteAccess is 1, the policy is active. Read access remains available. To completely deny all access (read and write) to unprotected removable drives, you need a separate Device Installation policy or a third-party DLP tool — the BitLocker GPO alone only controls write access.

How to Encrypt a USB Drive with BitLocker To Go

Once the write-deny policy is active, users need a way to encrypt their USB drives. Walk them through this process:

  1. Insert the USB drive and open File Explorer.
  2. Right-click the drive and select Turn on BitLocker. If this option is missing, the Control use of BitLocker on removable drives policy may be set to Not Configured or Disabled — enable it.
  3. Choose an unlock method. For most users, Use a password to unlock the drive is simplest. Smart card unlock is available for card-based environments.
  4. Set a strong password (minimum 8 characters; longer is better — the password is the only protector for the data at rest).
  5. Save the recovery key to a Microsoft account, a file, or print it. In a managed environment, configure the GPO to back up recovery keys to Active Directory or Azure AD automatically.
  6. Choose encryption mode. For drives used only on Windows 10/11, select New encryption mode (XTS-AES). For drives used on multiple operating systems or older Windows versions, select Compatible mode (AES-CBC).
  7. Click Start encrypting. Encryption time depends on drive size and speed.

To do this silently from PowerShell (requires admin rights):

# Enable BitLocker To Go on a removable drive with a recovery password # Replace E: with the actual drive letter Enable-BitLocker -MountPoint "E:" ` -EncryptionMethod XtsAes256 ` -RecoveryPasswordProtector ` -UsedSpaceOnly

Backing Up BitLocker To Go Recovery Keys to Azure AD

If users encrypt their USB drives and lose the password, recovery requires the 48-digit recovery key. Configure auto-backup so keys are never lost:

# Back up an existing BitLocker To Go recovery key to Azure AD $mountPoint = "E:" $keyId = (Get-BitLockerVolume -MountPoint $mountPoint).KeyProtector | Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" } | Select-Object -ExpandProperty KeyProtectorId BackupToAAD-BitLockerKeyProtector -MountPoint $mountPoint -KeyProtectorId $keyId

Intune Equivalent Policy

For Intune-managed devices, configure the same control via an Endpoint Security policy or a Settings Catalog profile:

  1. In Intune admin centre, go to Endpoint Security > Disk Encryption > Create Policy.
  2. Platform: Windows 10 and later. Profile: BitLocker.
  3. Under BitLocker removable drive policy, set Block write access to removable data-drives not protected by BitLocker to Yes.
  4. Optionally set Block write access to removable data-drives configured in another organization to Yes for strict cross-organisation control.
  5. Assign the policy to the appropriate device or user groups and save.
⚠️Do not apply both an Intune BitLocker removable drive policy and an on-premises GPO setting the same key to different values — this causes the same type of conflict as the BitLocker startup options conflict. Use one management path only for each setting.