I use Windows 11 Pro or Enterprise. At a conference, I’ve had to plug into my computer lots of USB drives from coworkers, and I don’t necessarily trust the USB drives to be virus-free. (note, however, BadUSB-type attacks don’t concern me, I trust these drives to be real USB storage devices.)
To browse the files in USB drives, I use a VirtualBox virtual machine. I manually pass the USB drive to the VM in the USB passthrough menu. The problem is the drive is still mounted temporarily for a brief time (during which windows may do potentially dangerous things like generating thumbnails for images/PDFs or indexing files for search).
I’d like mounting to be manual, like on Linux servers. The san Diskpart command works to “offline” disks by default (documentation). Set to “offlineAll”, I get to manually “online” the disk and to get it out of read-only using Diskpart commands if I wish to use the USB drive, which is exactly the goal.
However, it automounts drives it has already seen and I previously approved. I might “trust” a USB drive once, but once the portable drive has gone round and time has passed, I’d like to not automatically trust it. I don’t know how to clear this list of “trusted” disks.
Other options I’ve tried:
- The
automount disablecommand in diskpart, which doesn’t seem to prevent automounting, although only tested with previously-discovered USB drives (removed the drives and usedautomount scrub). - The
mountvol /Ncommand, which also doesn’t work - “All Removable Storage classes: Deny all access” in the Local Group Policy Editor path: Computer ConfigurationAdministrative TemplatesSystemRemovable Storage Access. This works to prevent mounting USB drives, but I can’t selectively mount any. I could with diskpart before.
- A Microsoft Learn page related to the OfflineAll policy mentions an older NoAutoMount Registry key, but it is superseded apparently, so I didn’t try it.
