Best Practice Summary

The safest setup is to create a security group for users who must be blocked, apply a user-based Group Policy, and use loopback processing when the rule must apply only on a specific server.

Before You Start

1. Log in with Domain Admin or delegated Group Policy permissions
2. Confirm the target users are Active Directory users
3. Identify the OU that contains the server computer object
4. Identify the OU that contains the user accounts
5. Keep one test user for blocked access and one for allowed access

Step 1: Create a Security Group for Blocked Users

1. Open Active Directory Users and Computers
2. Create a new group named USB_Deny_Users
3. Set:
   • Group Scope: Global
   • Group Type: Security
4. Add only the users who must be blocked from USB storage

Step 2: Create the User GPO

1. Open Group Policy Management by running gpmc.msc
2. Go to the OU where the target user accounts are located
3. Create a new GPO named USB Storage - Deny for Selected Users
4. Right-click the GPO and click Edit

Step 3: Configure the USB Storage Restriction

Go to the following path:

User Configuration
→ Policies
→ Administrative Templates
→ System
→ Removable Storage Access

Enable these policies:

• Removable Disks: Deny read access → Enabled
• Removable Disks: Deny write access → Enabled

Step 4: Security Filtering

1. Open the new GPO in Group Policy Management
2. Open the Scope tab
3. Remove Authenticated Users from Security Filtering
4. Add USB_Deny_Users

Step 5: Restore Read Permission for Computers

This is one of the most commonly missed steps. When removing Authenticated Users from Security Filtering, client computers still need Read permission on the GPO.

1. Open the Delegation tab of the GPO
2. Click Advanced
3. Add Authenticated Users or Domain Computers
4. Grant Read permission only
5. Do not grant Apply Group Policy to that entry

Step 6: Make It Apply on This Server Only (Loopback Processing)

This is the real server-side trick. Without loopback processing, user policy follows the user account and may apply in places you did not intend.

1. Locate the OU where the Windows Server 2022 computer object is placed
2. Create a new GPO named Server 2022 - Loopback USB Control
3. Link it to the OU containing the server computer object
4. Edit the GPO and go to:

Computer Configuration
→ Policies
→ Administrative Templates
→ System
→ Group Policy

5. Open User Group Policy loopback processing mode
6. Set it to Enabled
7. Select Merge mode

Step 7: Update Group Policy

Run these commands on the target server:

gpupdate /force

Then sign out and sign back in with the target user account.

Step 8: Validate the Result

Sign in using one blocked user and one allowed user and test both cases.

For the blocked user

• Plug in a USB storage device
• Confirm read access is denied
• Confirm write access is denied

For the allowed user

• Plug in a USB storage device
• Confirm the user can open files
• Confirm the user can copy files

Run this command to generate a policy result report:

gpresult /h C:\Temp\USB-Policy-Report.html

You can also use:

gpresult /r

Step 9: Troubleshooting Checklist

Standalone Server with Local Users Only

When the server is not using Active Directory user accounts, use Multiple Local Group Policy. This method is suitable for local users and local groups only.

1. Press Win + R
2. Type mmc
3. Click File → Add/Remove Snap-in
4. Select Group Policy Object Editor
5. Click Add
6. Click Browse
7. Open the Users tab
8. Select a specific local user, or choose Non-Administrators
9. Go to the same path:

User Configuration
→ Administrative Templates
→ System
→ Removable Storage Access

Enable:

• Removable Disks: Deny read access
• Removable Disks: Deny write access

Rollback Steps

1. Remove the user from USB_Deny_Users
2. Or set the two removable disk deny policies back to Not Configured
3. Run gpupdate /force
4. Sign out and sign in again
5. Retest the USB storage device

Final Recommendation

For most Windows Server 2022 environments, the best design is:

• Use a security group such as USB_Deny_Users
• Use a user GPO to deny removable disk read and write access
• Use loopback processing when the restriction must apply only on the server
• Validate using gpupdate and gpresult