At a conference, I’ve had to plug into my Windows 11 computer lots of USB drives from coworkers, and I don’t necessarily trust the USB drives to be virus-free. (note, however, BadUSB-type attacks don’t concern me, I trust these drives to be real USB storage devices.)
To browse the files in USB drives, I use a VirtualBox virtual machine. I manually pass the USB drive to the VM in the USB passthrough menu. The problem is the drive is still mounted temporarily for a brief time (during which windows may do potentially dangerous things like generating thumbnails for images/PDFs or indexing files for search).
I’d like for mounting to be manual, like on Linux servers. The san Diskpart command works to “offline” disks by default (documentation). Set to “offlineAll”, I get to manually “online” the disk and to get it out of read-only using Diskpart commands if I wish to use the USB drive, which is exactly the goal.
However, it automounts drives it has already seen and I previously approved. I might “trust” a USB drive once, but once it has gone round, I’d like to not automatically trust it. I don’t know how to clear this list of “trusted” disks.
Other options I’ve tried:
- The
automount disablecommand in diskpart, which doesn’t prevent automounting, although only tested with previously-discovered USB drives (usedautomount scrub). - The
mountvol /Ncommand, which also doesn’t work - “All Removable Storage classes: Deny all access” in the Local Group Policy Editor path: Computer ConfigurationAdministrative TemplatesSystemRemovable Storage Access. This works to prevent mounting USB drives, but I can’t selectively mount any. I could with diskpart before.
- A Microsoft Learn page related to the OfflineAll policy mentions an older NoAutoMount Registry key, but it is superseeded apparently, so I didn’t try it.
Windows 11 Pro/Enterprise.
