Recommended Free Tools
To require BitLocker on USB and other removable data drives, enable the policy Deny write access to removable drives not protected by BitLocker. When it is on, any removable data drive without BitLocker protection mounts read-only, so users can read files from it but cannot write to it. The policy makes encryption a condition of write access. It does not encrypt a drive automatically when someone inserts it, so you still need a process for getting drives protected before users need to write to them.
What the policy does to each drive
The behavior depends on two things: whether the policy is enabled, and whether the drive is BitLocker-protected.
As an Amazon Associate I earn from qualifying purchases.
- Policy enabled, drive not BitLocker-protected: the drive mounts read-only.
- Policy enabled, drive BitLocker-protected: the drive mounts read/write.
- Policy disabled or not configured: removable data drives keep read/write access by default, whether or not they are encrypted.
Microsoft’s Configure BitLocker documentation on Microsoft Learn describes the enabled behavior this way: “If you enable this policy setting, all removable data drives that are not BitLocker-protected are mounted as read-only.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enable the policy with Group Policy
Group Policy is the usual route for domain-joined computers and for a single standalone machine. Use the Group Policy Management Console to edit the GPO that applies to the target computers. On one standalone computer, use the Local Group Policy Editor (gpedit.msc) instead.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- Open the GPO for editing and go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives.
- Double-click Deny write access to removable drives not protected by BitLocker.
- Select Enabled, then click OK.
- Before rollout, review the recovery and encryption-type settings described below, because they are configured in the same area of the policy tree.
- On a test computer, open an elevated Command Prompt and run
gpupdate /force. Then insert an unprotected USB flash drive. Write attempts should fail with a write-protection error, and the drive should still open for reading.
A USB flash drive works well as a test device. The Microsoft guidance does not require a specific drive model.
Enforce the policy through MDM and Intune
For devices managed through a mobile device management (MDM) service, the equivalent control is the BitLocker configuration service provider (CSP) setting that sets the removable-drive requirement:
./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption
This is a device-scoped setting. Microsoft’s CSP reference lists it for Windows 10 version 1703 and later, on Pro, Enterprise, Education, and IoT Enterprise editions. Intune exposes the same control as Write access to removable data-drive not protected by BitLocker. Its Block choice gives read-only access to drives that are not BitLocker-protected.
The two management routes do the same job. Choose based on the management system you already use for the endpoints you need to cover.
| Management route | Where the setting lives | Scope | Platform and edition details |
|---|---|---|---|
| Group Policy (domain GPO or local policy) | Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives | Computer configuration | Not stated in the cited Microsoft Learn policy description |
| MDM (BitLocker CSP) | ./Device/Vendor/MSFT/BitLocker/RemovableDrivesRequireEncryption |
Device | Windows 10 version 1703 and later; Pro, Enterprise, Education, and IoT Enterprise editions, per Microsoft’s CSP reference |
| Intune | Write access to removable data-drive not protected by BitLocker (Block) | Not stated in Microsoft’s Intune documentation as summarized here | Not stated in Microsoft’s Intune documentation as summarized here |
Plan recovery before you enable the policy
Recovery is the part most likely to cause trouble after rollout. The removable-drive recovery policy in the same Group Policy folder controls the following:
Rank #2
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
- Whether users may generate a 48-digit recovery password or a 256-bit recovery key.
- Whether recovery options are omitted from the BitLocker setup wizard.
- Whether a data recovery agent is allowed.
- Whether recovery information is backed up to Active Directory Domain Services (AD DS).
- Whether BitLocker can be turned on at all before recovery information is stored in AD DS.
Microsoft’s guidance says the recovery-key option must be disallowed when the deny-write policy is enabled. Decide your recovery method first, then set the recovery policy to match it, and test that a user can still recover a drive.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteChoose full or used-space-only encryption
The setting Enforce drive encryption type on removable data drives lets you standardize whether drives are encrypted in full or only in the used space. Microsoft documents both options and does not recommend one universally, so base the choice on your encryption policy and how the drives are used.
When this policy is enabled, the encryption-type choice is removed from the setup wizard. It does not change a drive that is already encrypted or whose encryption is in progress.
Do not confuse it with a blanket removable-media block
Windows also has a general Removable Storage Access control, found at Computer Configuration > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny write access. It denies writes to the whole removable-storage class, regardless of encryption. That is a different control. If the goal is to allow writes to encrypted drives, use the BitLocker removable-drive policy instead.
Rollout checklist
- Confirm that every target device runs a supported Windows edition and version for the route you chose.
- Set the recovery policy and confirm that recovery information reaches AD DS or your chosen store.
- Choose full or used-space-only encryption and enforce it if you need consistency.
- Pilot the policy on representative drives and computers, including the USB flash drives your staff actually use.
- Tell users that unprotected drives will open read-only and explain how to protect a drive.
- Confirm the deployed setting with
gpresult /rfor Group Policy, or with your MDM console for device management.
If a drive still behaves unexpectedly
- An unprotected drive is read-only: this is the expected result. To write to it, turn on BitLocker. In File Explorer, right-click the drive and select Turn on BitLocker, then follow the wizard.
- A protected drive is still read-only: check that the BitLocker protection is actually on for that drive, then confirm the policy is applied on that computer with
gpresult /r. - The policy does not appear on a managed device: confirm the device meets the platform requirements in the table, then check the MDM console for the assignment and any conflicting profile.
Enabling this policy is the enforcement step. Recovery design, encryption-type standards, and user communication still need to be planned alongside it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
