Skip to content

Commit 028d973

Browse files
przlplxprzlplx
authored
AB#6885: Create Troubleshooting Guide: Managing Removable Devices through Group Policy (#10001)
* Create backup-fails-vss-writer.md * Update backup-fails-vss-writer.md
1 parent 46d03fd commit 028d973

File tree

1 file changed

+225
-0
lines changed

1 file changed

+225
-0
lines changed

‎support/windows-server/group-policy/backup-fails-vss-writer.md‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
---
2+
title: Managing Removable Devices Through Group Policy Troubleshooting Guidance
3+
description: Resolves issues in which GPOs and registry settings that control access to removable drives don't work as expected in Windows.
4+
ms.date: 10/08/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: kaushika
9+
ms.custom:
10+
- sap:Group Policy\Managing removable devices (USB devices and flash drives) through Group Policy
11+
- pcy:WinComm Directory Services
12+
appliesto:
13+
- <a href=https://learn.microsoft.com/windows/release-health/windows-server-release-info target=_blank>Supported versions of Windows Server</a>
14+
---
15+
16+
# Managing removable devices through Group Policy troubleshooting guidance
17+
18+
## Summary
19+
20+
This article provides detailed troubleshooting steps to resolve issues in which Group Policy Objects (GPOs) and registry settings to control access to USB flash drives and other removable storage devices don't work as expected. These issues occur in Windows environments, including Windows 11, 10, and Server editions. Such failures can occur because of product bugs (often after Windows updates), policy misconfiguration, registry and service conflicts, or inherent system limitations. Robust device control is essential for endpoint security, data loss prevention, and regulatory compliance. This article consolidates known failure modes and provides resolutions for IT professionals and administrators.
21+
22+
## Troubleshooting checklist
23+
24+
Use this checklist for systematic troubleshooting:
25+
26+
- **Verify symptoms**
27+
- Verify the issue (for example, unauthorized USB access, device allow list failure, legitimate device block, prompt to encrypt drive)
28+
- **Check GPO Application**
29+
- Run gpresult /h gpresult.html, and use rsop.msc to verify that targeted GPOs are applied.
30+
- Verify that the GPO is linked to the correct OU and assigned to computer or user as necessary.
31+
- **Review Registry Settings**: Confirm keys in:
32+
- HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices
33+
- HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR
34+
- Check for keys: Deny_Read, Deny_Write, Start
35+
- **Update Windows**
36+
- Make sure that the latest Windows updates and hotfixes are installed.
37+
- Cross-reference with known issue rollbacks (KIR) or advisories for your OS build.
38+
- **Audit local versus domain GPO application**
39+
- Determine where the restriction is being applied (domain, local, cloud-managed, Intune, and so on).
40+
- **Check for Product Bugs and KIRs**
41+
- Search for current ICMs, KB articles, and KIRs that affect removable storage policies.
42+
- **Inspect policy layering and inheritance**
43+
- Ensure policy precedence (no conflicting user-level or computer-level settings or inheritance that masks intended policy behavior).
44+
- **Verify device installation policies**
45+
- For allowlisting: Verify device IDs, instance paths, and setup class GUIDs.
46+
- Check whether previously installed devices and drivers exist.
47+
- **Examine registry and service conflicts**
48+
- Review presence and behavior of the HotplugSecureOpen registry key.
49+
- Check the WPDBusEnum service state.
50+
- **Assess connectivity and aAuthentication**
51+
- Verify that the device can contact domain controllers (especially when on VPN).
52+
- Verify that the user or device is in the correct security groups and meets authentication requirements.
53+
54+
## Common issues and solutions
55+
56+
The following sections detail the most common failure modes and provide step-by-step solutions.
57+
58+
### USB or removable storage policies not enforced after update bug
59+
60+
#### Symptoms
61+
62+
- Users can bypass storage policies after certain Windows Updates (for example, 2025.5B, KB5058379, KB5050092, KB5062552).
63+
- GPO appears to be applied (confirmed by gpresult), but access is not blocked.
64+
65+
#### Resolution
66+
67+
1. Apply the Known Issue Rollback (KIR) workaround:
68+
1. Download and install the affected update’s KIR MSI and policy template.
69+
1. Apply a registry override. For example:
70+
71+
```console
72+
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides /v <key> /t REG_DWORD /d 0 /f
73+
```
74+
75+
1. In gpedit.msc, set the new policy (KB5050092 or similar) to "Disabled."
76+
1. Restart the affected computers.
77+
78+
2. Update to the latest Windows build (for example, Windows 11 24H2) when it's available or permitted.
79+
80+
3. Refer to relevant KBs, known bug links, and internal advisories (see "References").
81+
82+
### Registry key (HotplugSecureOpen) regenerates after deletion
83+
84+
#### Symptoms
85+
86+
- The blocking registry key is deleted, but is re-created after a restart.
87+
- Policy enforcement fails until the key is deleted again.
88+
89+
#### Resolution
90+
91+
1. Disable the WPDBusEnum service to prevent key re-creation:
92+
93+
```console
94+
sc config WPDBusEnum start= disabled
95+
```
96+
97+
**Note:** Disabling the service might affect other device functionality.
98+
99+
2. Continue to monitor for permanent fixes (see KIR advisories link in "References").
100+
101+
### Device (allowlisting) fails or blocks all devices
102+
103+
#### Symptoms
104+
105+
- Devices intended to be allowed by device instance ID are blocked if "Deny all removable storage" GPO is also applied.
106+
- Removing the block allows the device, but breaks policy intent.
107+
108+
#### Resolution
109+
110+
1. Move block policy settings from user to computer level GPO.
111+
2. Remove all "Removable Storage Access" user policies.
112+
3. Create a new GPO at computer level:
113+
- Enable "Apply layered order" for allow/deny device installation.
114+
- Block installation by setup class for USB drives.
115+
- Add allowed devices by instance ID or hardware ID.
116+
4. Use gpresult /h report.html and Device Manager to verify enforcement.
117+
118+
### CD, DVD, or other devices blocked unintentionally (global policy overlap)
119+
120+
#### Symptoms
121+
122+
- CD and DVD drives are inaccessible, even if only USB devices should be blocked.
123+
- Scanners and printers that are attached through USB aren't recognized.
124+
125+
#### Resolution
126+
127+
1. Adjust GPO:
128+
- Make sure that "All Removable Storage Classes: Deny All Access" isn't set if only USB is intended to be blocked.
129+
- Use more targeted class IDs or exclude CD and DVD-specific blocks.
130+
2. Apply the update (gpupdate /force), restart the device, and retest.
131+
3. For scanners and printers, consult device manager for class GUID, and allow as an exception, if possible.
132+
133+
### GPO isn't applied over VPN, or no domain connectivity
134+
135+
#### Symptoms
136+
137+
- GPO and registry indicate correct configuration, but user experiences unrestricted access when on VPN.
138+
- Logs show "There is no connectivity. Waiting for connectivity again"
139+
140+
#### Resolution
141+
142+
1. Verify that the device can contact all required domain controllers when on VPN.
143+
2. Collect and review GPSVC and network logs.
144+
3. Consult Directory Services team to resolve DC replication or access issues.
145+
146+
### Legacy and unsupported device or system limitation
147+
148+
#### Symptoms
149+
150+
- Can't restrict devices that are connected through RS232, GPIB, or similar interfaces.
151+
- No GPO available in Home editions.
152+
153+
#### Resolution
154+
155+
- Registry-only method for Windows XP and Home editions:
156+
157+
```console
158+
reg add HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start /t REG_DWORD /d 4 /f
159+
```
160+
161+
- For non-PNP interfaces (RS232/GPIB), third-party tools and DLP solutions are required.
162+
163+
### Deny\_Write or Deny\_Read Settings don't persist or are overwritten
164+
165+
#### Symptoms
166+
167+
- Registry keys that are manually set are reverted after running gpupdate /force.
168+
- Can't unblock devices despite registry editing.
169+
170+
#### Resolution
171+
172+
1. Set required values in the correct policy-managed registry location.
173+
2. Disable the GPO that sets Deny_Write/Deny_Read. Then, run gpupdate /force.
174+
3. Restart the system and verify the behavior.
175+
176+
### BitLocker enforcement, unexpected encryption prompt
177+
178+
#### Symptoms
179+
180+
- Users are prompted to encrypt a USB drive before writing (outside of BitLocker policy intent).
181+
182+
#### Resolution
183+
184+
- Review assigned GPOs and BitLocker removable device policies.
185+
- Adjust as intended. Remove or set BitLocker removable storage policies as necessary.
186+
187+
## Common issues quick reference table
188+
189+
| Symptom | Root cause | Quick fix | Reference |
190+
| --- | --- | --- | --- |
191+
| Policy not enforced after update | Known bug in recent update | Apply KIR or registry override; install fixed OS build | KB5050092, KIR |
192+
| Registry key (HotplugSecureOpen) regenerates | Policy conflict after update | Disable WPDBusEnum service | KIR |
193+
| Device allowlisting ignored | User-level policy overrides | Use computer-level GPO; enable layered order, remove user policies | |
194+
| CD/DVD, scanner, or printer access blocked | Overbroad access block | Remove "Deny All" policy; use device-specific policies | |
195+
| GPO not applied (VPN) | DC connectivity issue | Check VPN config, test on LAN, gather GPSVC/network logs | |
196+
| Manual registry change doesn't persist | GPO overriding | Remove/modify GPO, gpupdate, restart | |
197+
| BitLocker prompt unexpected | BitLocker GPO enforced | Review GPO, adjust BitLocker removable storage settings | |
198+
| Device blocking fails on Home edition | No GPO available | Use registry method, accept limitations | |
199+
| RS232/GPIB not blocked | OS not PNP aware, not removable class | Require third-party or DLP tools | |
200+
| Allow list not working | Policy layering/order, driver preinstall | Uninstall device, reapply GPO, use setup class GUID and instance ID | |
201+
202+
## Data collection
203+
204+
Before you contact Microsoft Support, you can gather the following information about your issue.
205+
206+
- Group Policy Results:
207+
- gpresult /h gpresult.html
208+
- Use rsop.msc for GUI view
209+
- Registry Exports:
210+
- reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" usbpols.reg
211+
- reg export "HKLM\SYSTEM\CurrentControlSet\Control\Storage" storage.reg
212+
- Policy Application Logs:
213+
- Review C:\Windows\INF\setupapi.dev.log
214+
- C:\Windows\Logs\StorGroupPolicy.log if present
215+
- Service State:
216+
- sc query WPDBusEnum
217+
- Device Manager:
218+
- Collect class GUID, device instance path/ID of affected/allowed devices
219+
- Event Viewer:
220+
- Filter for policy processing and device installation events
221+
- Process Monitor (Procmon):
222+
- For drive access or permission errors
223+
224+
## References
225+
- [Windows registry key reference](/windows/win32/sysinfo/registry)

0 commit comments

Comments
 (0)