How to Disable USB Ports in Windows 11 Laptop or PC

What it does: USBSTOR is the driver for USB mass storage. Setting it to 4 stops Windows loading it. USB keyboards, mice and headsets use other drivers and keep working.

1. Open Start, type cmd, right-click Command Prompt and choose Run as administrator.
2. Run the command below.
3. Unplug any USB drive that is already connected, then reconnect it to test. A restart makes the change certain.

reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f

Undo: Set the value back to 3: reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 3 /f

What it does: This policy denies access to every removable storage class, not only USB sticks. It covers external disks, optical drives and portable devices such as phones. It does not touch keyboards or mice.

1. Press Win + R, type gpedit.msc and press Enter.
2. Go to Computer Configuration → Administrative Templates → System → Removable Storage Access.
3. Open All Removable Storage classes: Deny all access, choose Enabled, then Apply and OK.
4. Refresh the policy with the command below, then test with a USB drive.

gpupdate /target:computer /force

Undo: Set the policy to Not Configured or Disabled, then run gpupdate /force.

What it does: Windows 11 Home has no Group Policy editor, but the policy is just a registry value. This writes the value that “Deny all access” would write.

1. Open PowerShell as administrator (right-click Start, choose Terminal (Admin)).
2. Paste the commands below and press Enter.
3. Restart the PC, then test a USB drive.

New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" -Name Deny_All -PropertyType DWord -Value 1 -Force

Undo: Remove-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices" -Name Deny_All

What it does: Device Installation Restrictions stop Windows installing a driver for new removable devices. It works best together with Fix 2, because a device Windows already installed may keep working.

1. Open gpedit.msc and go to Computer Configuration → Administrative Templates → System → Device Installation → Device Installation Restrictions.
2. Enable Prevent installation of removable devices.
3. Optional: add a custom message so people know the block is intentional.
4. Run gpupdate /target:computer /force and restart.

Undo: Set the policy back to Not Configured.

What it does: Disabling a USB Root Hub or controller turns off every port behind it. Keyboards, mice, headsets and webcams on those ports stop working too.

1. Make a restore point first: search Create a restore point and choose Create.
2. Right-click Start and open Device Manager. Expand Universal Serial Bus controllers.
3. Right-click a USB Root Hub (or host controller) and choose Disable device. Confirm.
4. Test with a USB drive. Repeat for other hubs only if needed.

Undo: Right-click the disabled hub and choose Enable device. If you cannot use the input, see Fix 13.

What it does: Windows does not label ports on the case. You find the right hub by plugging a device in and watching where it appears.

1. Open Device Manager. Choose View → Devices by connection.
2. Plug a USB device into the port you want to block and watch which USB Root Hub branch shows a new entry.
3. Check what else sits on that hub. If your keyboard or mouse is there, pick a different port to test.
4. Disable only that hub, or use Fix 7 with its Instance ID.

What it does: Use these to script Fix 1, or to disable a specific device by its Instance ID. Cmd and PowerShell do the same things as the manual steps.

1. Open Terminal (Admin).
2. List USB devices and note the InstanceId of the one you want.
3. Disable it with the second command. Enable it again with the third.

Get-PnpDevice -Class USB | Select-Object FriendlyName, Status, InstanceId
Disable-PnpDevice -InstanceId "PASTE_INSTANCE_ID_HERE" -Confirm:$false
Enable-PnpDevice -InstanceId "PASTE_INSTANCE_ID_HERE" -Confirm:$false

Undo: Run Enable-PnpDevice with the same Instance ID.

What it does: Firmware settings turn ports off before Windows loads. Software cannot switch them back on. This is the real way to disable ports.

1. Restart and press the setup key as it starts (often F2, Del, F10 or F12, depending on the maker).
2. Look for USB Configuration, Integrated Peripherals or Security → I/O Port Access.
3. Disable the USB ports you want off, or USB storage if offered. Save and exit.
4. Set a BIOS or supervisor password so others cannot undo it.

Undo: Enter setup again and set the ports to Enabled.

What it does: Cloud-managed PCs can block USB storage and still allow approved devices, by hardware ID or serial number, with reports.

1. In Microsoft Intune, open Endpoint security → Attack surface reduction and create a Device control or removable-storage policy (names vary by licence).
2. Start with a pilot group. Add an allow list for approved devices.
3. Assign to your devices and check reports for blocked events.
4. On domain PCs without Intune, combine Fix 2 and Fix 4 in a Group Policy Object linked to the right OU.

Undo: Remove the assignment or set the policy to Not configured.

What it does: Plastic or lockable port blockers are the only method that works even if someone has admin rights.

1. Buy blockers sized for USB-A or USB-C ports, with lockable ones for shared PCs.
2. Fit one in each port you want blocked.
3. For USB-C and Thunderbolt, remember the port may also carry charging and video. Blocking it can stop charging, so keep one charging port free.

Undo: Remove the blockers.

What it does: This is the opposite problem: Windows powers down idle USB ports to save energy. Devices then disconnect or stop responding.

1. Open Control Panel → Power Options → Change plan settings → Change advanced power settings.
2. Open USB settings → USB selective suspend setting and set it to Disabled for plugged in and on battery.
3. In Device Manager, open each USB Root Hub → Properties → Power Management and clear Allow the computer to turn off this device to save power.
4. Or run the commands below as administrator.

powercfg /setacvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
powercfg /setdcvalueindex SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
powercfg /setactive SCHEME_CURRENT

Undo: Set the same value to 1 to enable selective suspend again.

What it does: Each method has its own undo. Use the one that matches, then restart.

1. Registry USBSTOR: set Start back to 3.
2. Group Policy: set the policy to Not Configured and run gpupdate /force.
3. Home registry policy: delete Deny_All.
4. Device Manager or PowerShell: Enable device or Enable-PnpDevice.
5. BIOS: set the ports to Enabled.
6. Intune: remove the assignment, then sync the device.

reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 3 /f
gpupdate /force

What it does: Most “USB still works” cases are a scope mismatch, a phone using MTP, or a policy that did not refresh. Most lockouts come from disabling hubs your input uses.

1. Drive still works: unplug and reconnect it, restart, and run gpupdate /force. A device that was already installed can keep working until you unplug it.
2. Phone still transfers files: phones use MTP. Use Fix 2 or 3, which cover portable devices.
3. Policy not applying: check that the policy is under Computer Configuration and that you edited the correct GPO or OU.
4. Keyboard or mouse dead after Fix 5: use the laptop touchpad, an on-screen keyboard, a Bluetooth keyboard, or a remote session to re-enable the hub. If that is impossible, restore from System Restore in Windows Recovery.
5. Charging stopped after a BIOS change: re-enter setup and re-enable the charging port.