Deny write access to removable drives not protected by BitLocker
This computer policy makes write access to a removable data drive dependent on the drive's BitLocker protection status.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\System\CurrentControlSet\Policies\Microsoft\FVE\RDVDenyWriteAccessHKLM\Software\Policies\Microsoft\FVE\RDVDenyCrossOrg
This computer policy makes write access to a removable data drive dependent on the drive's BitLocker protection status.
RDVDenyWriteAccess is a REG_DWORD value. When set to 1, Windows mounts removable data drives that are not protected by BitLocker as read-only. BitLocker-protected removable drives can still be mounted with read and write access. A value of 0 disables this restriction; if the value is absent, the policy is not configured.
The policy does not automatically encrypt existing drives. It restricts their writability according to the BitLocker protection status recognized by Windows.
Notes
Additional effects
RDVDenyCrossOrg is a subordinate option of the same policy and is also a REG_DWORD value. It has an effect only while RDVDenyWriteAccess is enabled.
When RDVDenyCrossOrg is set to 1, a BitLocker-protected removable drive is writable only if its BitLocker identification fields match the organization identifiers configured for the computer. Other drives are mounted as read-only. These identification fields are supplied by the separate “Provide the unique identifiers for your organization” policy.
A value of 0 does not enforce this additional organization check.
Security
The policy prevents users and applications from writing data to removable drives that are not protected by BitLocker. It can therefore reduce the risk of data being stored or transferred on unencrypted removable media. Enabling the organization check can further limit writing to appropriately identified BitLocker-protected drives.
This policy does not block read access. It also does not replace file-system permissions or grant write access that is denied by another access-control mechanism.
Possible side effects
Applications cannot create, modify, or delete files on affected drives. This also applies to removable media protected by another encryption product if Windows does not recognize the drive as BitLocker-protected.
When the organization check is enabled, BitLocker-protected drives belonging to another organization, or drives without matching identification fields, can be used only in read-only mode.
Notes
If the “Removable Disks: Deny write access” policy under Removable Storage Access is enabled, this BitLocker policy is ignored because the broader policy denies writing regardless of BitLocker status.
Microsoft also notes that certain BitLocker configurations using startup keys or recovery keys must be disallowed when this policy is enabled. Recovery passwords are a distinct BitLocker recovery mechanism.
Microsoft documentation
Microsoft Learn: BitLocker CSP – RemovableDrivesRequireEncryption