Open Device Manager
Expand Universal Serial Bus controllers
Right-click each USB Mass Storage Device or USB Root Hub
Select Disable device
Confirm the action
Open Group Policy Editor
Go to Computer Configuration
Go to Administrative Templates
Go to System
Go to Removable Storage Access
Enable all relevant deny policies
Open Registry Editor
Go to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesUSBSTOR
Set Start to 4
Restart the computer
Use BIOS or UEFI settings to disable USB ports if available
Use endpoint management software to block USB storage if available