第一種方式：電腦已安裝過 USB 隨身碟
一：開始/執行 / Regedit
「HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USB-STOR」機碼，右窗格「Start」修改該「DWORD」數值為「4」。
二：開啟您的 GPO 本機或網域都可以
「使用者設定\系統管理範本\系統」 右窗格「禁止存取登錄編輯工具」設定啟用。
第二種方式：電腦未安裝過 USB 隨身碟
一：「我的電腦」－＞「工具」－＞「資料夾選項」－＞「檢視」－＞「進階設定」－＞取消 「使用簡易檔案共用」確定。
二：一：「我的電腦」－＞「工具」－＞「資料夾選項」－＞「檢視」－＞「進階設定」－＞「顯示所有檔案和資料夾」確定。
三：到「Windows\inf」資料夾找到「usb-stor.inf」這個檔案，選取滑鼠右鍵「內容」
四：將該檔案「安全性」權限設定一下吧！該拒絕的使用者就將其deny
五：到「Windows\inf」資料夾找到「usbstor.PNF」這個檔案，選取滑鼠右鍵 「內容」
六：將該檔案「安全性」權限設定一下吧！該拒絕的使用者就將其deny
以上步驟的前提是使用者必需是「受限的帳戶」。
If a USB Storage Device Is Already Installed on the Computer
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. If a USB storage device is already installed on the computer, set the Start value in the following registry key to 4:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
When you do so, the USB storage device does not work when the user connects the device to the computer. To set the Start value, follow these steps: 1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. Locate, and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor
4. In the right pane, double-click Start.
5. In the Value data box, type 4, click Hexadecimal (if it is not already selected), and then click OK.
6. Quit Registry Editor.
If a USB Storage Device Is Not Already Installed on the Computer
If a USB storage device is not already installed on the computer, assign the user or the group Deny permissions to the following files: • %SystemRoot%\Inf\Usbstor.pnf
• %SystemRoot%\Inf\Usbstor.inf
When you do so, users cannot install a USB storage device on the computer. To assign a user or group Deny permissions to the Usbstor.pnf and Usbstor.inf files, follow these steps: 1. Start Windows Explorer, and then locate the %SystemRoot%\Inf folder.
2. Right-click the Usbstor.pnf file, and then click Properties.
3. Click the Security tab.
4. In the Group or user names list, click the user or group that you want to set Deny permissions for.
5. In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
6. Right-click the Usbstor.inf file, and then click Properties.
7. Click the Security tab.
8. In the Group or user names list, click the user or group that you want to set Deny permissions for.
9. In the Permissions for UserName or GroupName list, click to select the Deny check box next to Full Control, and then click OK.
