PowerShell: disable USB storage devices
The script
Set the Start value of the USBSTOR service to 4 (disabled). Windows then refuses to load the mass-storage driver, so flash drives and external disks stop mounting. Keyboards, mice and printers are unaffected. Set it back to 3 to re-enable.
# disable USB mass storage
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR' -Name Start -Value 4
# re-enable later
# Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR' -Name Start -Value 3Notes before you run it
- A device that is already mounted stays mounted until it is unplugged; this stops the next mount, not the current one.
- This blocks mass-storage class devices only. Phones in MTP mode use a different driver stack and need device installation restrictions (GPO or Intune) to block properly.
- For managed fleets prefer the policy route (Removable Storage Access policies); the registry value is the quick fix for one-off machines and the thing those policies set underneath.
- A determined user with admin rights can set the value back; this is a guardrail, not a security boundary.
Run it on every machine, not one at a time.
Save any of these as a command in Moorfox and run it on a machine in one click, output and exit code captured, with no PSRemoting or WinRM setup. The agent runs it locally and reports back, even over the internet.