How to Block Program Installations from USB Drives Using Group Policy in Windows Server 2025
Stop users from launching installers directly from USB storage on domain-joined Windows computers. Configure removable-disk execution controls, block Windows Installer media sources, and deploy the policy safely through a dedicated GPO.
A common endpoint-security requirement in an Active Directory environment is to prevent users from installing software they bring in on a USB flash drive. Windows provides more than one control for this, and the distinction matters: blocking execution from a removable disk is not identical to blocking Windows Installer packages whose source is removable media.
1. Understand which policy blocks what
Do not treat “USB installation blocking” as a single Windows setting. Select the controls based on the behavior you need to prevent.
| Control | What it blocks | What it does not guarantee |
|---|---|---|
| Removable Disks: Deny execute access | Launching executable content from the removable-disk class. | Does not stop a user copying an installer to the local disk and launching it there. It is not a universal installer restriction. |
| Prevent removable media source for any installation | Windows Installer (.msi) installations that use removable media as the source. | Does not block every .exe setup program, portable application, script or installer copied to the local disk. |
| AppLocker / application control | Can restrict executable, script, MSI and other supported application types according to configured rules. | Requires a carefully designed allow/deny policy and testing; it is not automatically a USB-only control. |
2. Plan the deployment scope
Use a dedicated computer OU for the pilot. For example:
contoso.com
└── Workstations
├── Pilot-USB-Install-Block
├── Office-Computers
└── Production-ComputersMove one or two representative test computers into Pilot-USB-Install-Block. The removable-disk execution setting is a computer policy, so link the GPO to an OU containing computer accounts. The Windows Installer media-source setting is a user policy, so ensure the user accounts being tested are in scope for the linked GPO (or use loopback processing deliberately if your design is computer-scoped).
3. Create and link the Group Policy Object
Open Group Policy Management
On the Windows Server 2025 domain controller or an administration workstation with Group Policy Management installed, open Server Manager > Tools > Group Policy Management, or run:
gpmc.mscCreate a dedicated GPO
Expand Forest > Domains > your domain. Right-click the pilot OU and select Create a GPO in this domain, and Link it here…. Name it:
SEC - Block Program Installation from USBEdit the new GPO
Right-click the GPO and select Edit. Configure the computer and user settings described in the next sections.
Check security filtering and delegation
For a straightforward pilot, leave Authenticated Users if that matches your OU design. If you use a security group for filtering, ensure the computer accounts have Read and Apply Group Policy permissions for computer settings, and the relevant user accounts have the required permissions for user settings. Avoid filtering out the computer or user unintentionally.
4. Block program execution from USB removable disks
This is the main setting to stop executable files from being launched directly from USB mass-storage drives.
Navigate to the policy
In Group Policy Management Editor, go to:
Computer Configuration
> Policies
> Administrative Templates
> System
> Removable Storage AccessEnable the execute restriction
Open Removable Disks: Deny execute access, select Enabled, then click Apply and OK.
This denies execute access to the removable-disks storage class. It does not deny reading or writing files by itself, so users may still be able to browse the USB drive and copy data depending on your other policies.
5. Block Windows Installer packages from removable media
The next setting addresses Windows Installer (.msi) packages whose installation source is removable media. It is a user policy.
Navigate to Windows Installer policies
In the same GPO editor, go to:
User Configuration
> Policies
> Administrative Templates
> Windows Components
> Windows InstallerEnable Prevent removable media source for any installation
Open Prevent removable media source for any installation, select Enabled, then click Apply and OK.
When enabled, Windows Installer prevents users from installing programs from removable media such as CD-ROMs, floppy disks and DVDs. Microsoft documents that the policy applies even when the installation runs in the user’s own security context.
6. Cover EXE installers, scripts and applications copied from USB
The two settings above are a practical baseline, but they do not create a complete application-control boundary. A user may copy setup.exe from a USB drive to the desktop or Downloads folder and run it from there. The removable-disk execute restriction no longer applies to that local path, and the MSI media-source setting does not govern arbitrary EXE installers.
For stronger control, use AppLocker or Windows Defender Application Control (App Control for Business) with an allow-list strategy appropriate to your estate. AppLocker can manage executable, Windows Installer, script, packaged app and DLL rule collections through Group Policy. For a pilot:
- In the GPO editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Application Control Policies > AppLocker.
- Review the Executable Rules and Windows Installer Rules collections.
- Create the required default rules first so Windows and approved program locations remain usable.
- Build allow rules for approved publishers, signed software or controlled paths. Use deny rules only after evaluating rule precedence and exceptions.
- Set the relevant collection to Audit only first, review the AppLocker event logs, then move to Enforce rules after validating business applications.
For a narrow requirement to block execution specifically from a known removable drive letter, a path-based AppLocker rule can be considered only where drive-letter assignment is controlled and predictable. USB drive letters are not inherently fixed, so a static E:\\* rule is not a reliable universal USB policy. Prefer the removable-storage execute policy for removable-disk class enforcement and application control for broader software governance.
7. Apply and verify the policy on client computers
Refresh Group Policy
Sign in to a pilot client and open an elevated Command Prompt or PowerShell window. Run:
gpupdate /forceIf you want to refresh only computer policy:
gpupdate /target:computer /forceFor the Windows Installer setting, refresh user policy as well:
gpupdate /target:user /forceSome policy changes may require signing out and signing back in, restarting an application, or rebooting the client before the behavior is fully reflected. Follow the prompt from gpupdate.
Confirm the applied GPOs with gpresult
Generate a Resultant Set of Policy report:
gpresult /h C:\\Temp\\USB-Install-Policy.html
start C:\\Temp\\USB-Install-Policy.htmlReview both the Computer Details and User Details sections. Confirm that SEC – Block Program Installation from USB appears under Applied Group Policy Objects for the relevant computer and user. Check the winning policy and any denied GPOs.
Check the policy registry values (diagnostic only)
The removable-disk execute setting is a computer policy. The Windows Installer media setting is a user policy. You can inspect their resultant registry values with:
# Computer policy: removable disks deny execute
reg query "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\RemovableStorageDevices\\{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" /v Deny_Execute
# User policy: prevent removable media as Windows Installer source
reg query "HKCU\\Software\\Policies\\Microsoft\\Windows\\Installer" /v DisableMediaRegistry inspection is a troubleshooting aid, not a substitute for testing the actual behavior. The policy’s presence in the registry does not prove every application type is blocked.
8. Test the policy before production rollout
Use a controlled USB drive containing harmless test files. Do not test with untrusted malware or production installers.
| Test | Expected result with baseline policies |
|---|---|
| Run a harmless executable directly from USB | Execution should be denied by Removable Disks: Deny execute access. |
| Launch an MSI package directly from USB | Windows Installer should block the removable-media source for the scoped user. |
| Copy an EXE installer from USB to Downloads and run it | The baseline policies alone may not block it. This demonstrates why application control is required for broader enforcement. |
| Run an approved business application from Program Files | It should continue to work. If AppLocker is deployed, verify the relevant allow rules. |
| Use USB storage for ordinary documents | It should remain accessible if only execute access is denied and no read/write restrictions are configured. |
Record the computer, signed-in user, test file location, outcome and relevant event-log entries. Only move the GPO to the production workstation OU after the pilot passes.
9. Common pitfalls and troubleshooting
| Symptom | Likely cause and action |
|---|---|
| USB executable still runs | Confirm the drive is recognized as a removable disk, the computer policy applied, and no scope/filtering issue exists. Test from the removable volume itself, not a local copy. |
| MSI still installs from USB | Check that the user policy applied to the signed-in user. Verify the GPO link, user OU, security filtering and resultant DisableMedia value. |
| Only one half of the GPO applies | Computer and user settings have different scope. Use gpresult for both contexts and correct OU linking or loopback design. |
| Another GPO changes the result | Review GPMC link order, inheritance, Enforced links, Block Inheritance, security filtering and the winning policy shown by gpresult/RSOP. |
| EXE copied locally still launches | This is expected. Removable-disk execute access controls execution from removable disks; it is not a general application allow-list. Add AppLocker or App Control. |
| Users cannot access USB files at all | Check whether All Removable Storage classes: Deny all access or read/write restrictions were enabled. Those settings are broader than deny execute. |
| AppLocker blocks a legitimate app | Review the relevant event logs, rule collection, default rules, exceptions and merged GPO policy. Return to Audit only while correcting the rule design. |
For AppLocker troubleshooting, review Applications and Services Logs > Microsoft > Windows > AppLocker, including the EXE and DLL, MSI and Script, and packaged app logs as applicable. For Group Policy processing errors, review the Group Policy operational log under Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational.
10. Recommended production rollout
- Document the business requirement: block USB execution only, block MSI media sources, or enforce approved applications only.
- Create a dedicated GPO and pilot OU. Keep the baseline removable-disk and Windows Installer settings clearly named and documented.
- Test both user and computer policy scope with representative accounts and Windows client versions.
- Confirm that legitimate deployment tools, endpoint security, software updates and support workflows continue to work.
- If broader control is required, deploy AppLocker in Audit only, analyze events, build a tested allow policy, then enforce in phases.
- Expand the GPO link to production OUs in stages and maintain a rollback plan.
11. Frequently asked questions
Does Removable Disks: Deny execute access block all USB access?
No. It denies execution from the removable-disk class. Users may still read and write files unless separate read, write or deny-all policies are configured.
Does Prevent removable media source for any installation block EXE setup files?
No. It is a Windows Installer policy for installations using removable media as the source. It is not a general EXE, script or portable-application execution control.
Can users copy an installer to the local drive and run it?
Yes, the two baseline policies do not reliably prevent that scenario. Use application control such as AppLocker or App Control for Business to restrict what can execute from local paths.
Why does the GPO apply to the computer but not the user?
Computer Configuration is evaluated for the computer account, while User Configuration is evaluated for the signed-in user. Link or scope the GPO so both objects receive the intended settings, or use loopback processing when appropriate.
Should I enable All Removable Storage classes: Deny all access?
Only if the requirement is to block all access to removable storage classes. It is much broader than blocking program execution and can prevent legitimate USB data access.
Should I use AppLocker instead of these two settings?
Use the removable-storage and Windows Installer settings for their specific behaviors. Add AppLocker or App Control when you need a broader application allow-list that also addresses programs copied to local storage.
Conclusion
For a practical domain baseline, enable Removable Disks: Deny execute access in Computer Configuration and Prevent removable media source for any installation in User Configuration. Deploy the GPO to a pilot OU, verify both policy scopes with gpupdate and gpresult, and test USB execution and MSI installation separately. If your security requirement includes EXE installers or files copied to local disks, add a properly tested application-control policy. This layered approach is more reliable than assuming one USB setting blocks every route to software installation.