Keep business files from leaving through unapproved USB devices. Control storage access, allow trusted hardware, and manage transfer channels on your Windows PC.
Choose a task to control USB storage, allow trusted drives or network adapters, restrict other transfer channels, and review activity on Windows. Start with the first-policy walkthrough or jump directly to the setting you need.
Use one PC and two test drives to check the complete workflow before applying more device restrictions. The controls below govern access on the configured Windows PC; they do not encrypt existing files or physically switch off USB power.
Install GiliSoft USB Lock on the Windows PC with administrator permission. Set the management password, configure its recovery email, and record the starting settings. Close files open on removable storage and prepare an approved drive plus an unknown disposable test drive.
Follow installation and password setup and recovery email settings for the detailed administrator steps.
Open Control Center > USB & CD Lock. Select Disable Writing to USB Disk when files should remain readable but new writes must be blocked. Select Disable Reading USB Disk as well when unapproved storage must not be read or written. Leave unrelated device controls unchanged.
Use the independent block read and write or write-only restriction tutorial below. Keep the keyboard, mouse, and required management connection available while testing.
Under Trusted Devices White-list, select Add. In Select USB Drive, identify the intended drive, review its label and Permission, and confirm with OK. Review the actual device rather than treating a drive letter as permanent identity.
Follow Allow an Approved USB Drive for the device-selection dialog. A storage approval does not approve a USB network adapter; use USB Ethernet Whitelist for adapters.
Reconnect the approved and unknown test drives. Open a sample file and attempt to save a new sample file on each, checking the configured default and whitelist permissions. Confirm required peripherals still work and verify that the administrator can restore the specific access rule.
Continue with the full verification checklist. If the result is wrong, restore only the relevant access setting and check other Windows or endpoint policies.
| Your goal | Use this control |
|---|---|
| Stop files being copied from the PC to USB | Disable Writing to USB Disk; leave reading permitted. |
| Block reading and writing on unknown storage | Select both USB disk reading and writing restrictions. |
| Keep approved company drives usable | Add them to Trusted Devices White-list and review their permissions. |
| Block unapproved USB Wi-Fi or Ethernet | Use USB Ethernet Lock and its separate adapter whitelist. |
| Restrict phones, SD cards, or optical media | Use the corresponding options in USB & CD Lock. |
Use storage rules for flash drives and external disks, the separate USB Ethernet page for USB network adapters, and the dedicated phone or media controls for those channels. A single storage checkbox does not cover every connected device.
Sign in to USB Lock and open Control Center > USB & CD Lock. Review Trusted Devices White-list so approved-device exceptions are understood before testing a default block.
Select Disable Reading USB Disk and Disable Writing to USB Disk. Leave Block Non-System Drives unchanged unless that broader storage scope is also intended. Follow any confirmation prompts in the installed version.
Use a disposable drive not approved by the whitelist. Attempt to open a sample file and save a new sample file; both operations should follow the configured restriction. Test the approved drive separately rather than assuming every disk should be blocked.
The pictured USB disk reading and writing restrictions are unchecked, so it illustrates where the controls are, not an active read/write block. See block USB storage devices for that focused scenario.
Open Control Center > USB & CD Lock. Select Disable Writing to USB Disk and leave Disable Reading USB Disk unchecked.
Check the permissions of any relevant Trusted Devices White-list entries, then reconnect the test drive. Keep unrelated phone, optical-media, and network controls unchanged.
Open a sample file from the disposable test drive, then attempt to copy a new sample file from the PC to it. Reading should work while writing follows the restriction. A readable file is not evidence that a writing-only rule failed.
Use the USB & CD Lock screenshot to locate the two separate options. Read prevent copying files to a USB drive for the PC-to-USB transfer scenario.
Connect the reviewed company drive. Open USB & CD Lock and select Add under Trusted Devices White-list.
In Select USB Drive, choose the intended USB Drive, review Permission and Label name, then confirm with OK. The illustration shows a Read - Write entry; choose the permission offered by your installed version that matches the policy.
Reconnect both devices and test actual file reading and writing against the same default rule. Review the stored entry after reconnecting; do not approve an unfamiliar drive merely because it has the same volume label.
Use Export and Import the Storage Whitelist when reusing the list. See the USB whitelisting walkthrough for multi-PC setup.
Keep the source USB disconnected, record the starting policy, and prepare a separate destination for copied files and reports. Use a disposable drive for the first test.
Open USB & CD Lock and enable Computer forensics mode. Check that the intended USB reading is allowed and writing is blocked, including the effect of any trusted-device permissions.
Read and copy a sample file from the disposable test drive to the separate destination, then attempt a new test write to that drive. If writes remain possible, stop and correct the configuration before inspecting source media.
The mode is shown in the storage control screenshot. Follow the read-only inspection guide for recording the device, testing write restrictions, and keeping inspection outputs off the source drive. This local software policy is not a claim of universal hardware write-blocking or built-in forensic hashing.
Add and test the approved drives under Trusted Devices White-list. Remove obsolete entries before preparing the list for reuse.
Select Export in USB & CD Lock, retain the exported list securely, then use Import on the destination PC. Review the resulting device entries and permissions.
Set that PC's read/write rules, phone and media restrictions, administrator security, and any USB Ethernet exceptions. A storage-list import is not a full-policy backup and does not establish a centralized management service.
Test the actual devices with the account used on the destination PC. Verify reading, writing, and the administrator restore route before moving on to another computer.
See the complete multi-PC whitelist guide.
Open Control Center > USB Ethernet Lock on the installed version that provides it. Keep a working management connection available while preparing the first test.
Connect the reviewed adapter and select Add under USB Ethernet Whitelist. In Select USB Ethernet, choose the intended adapter and confirm with OK.
Check USB Ethernet Name and USB Ethernet ID in the list, then select Disable USB Ethernet. A storage whitelist entry does not also approve a network adapter.
Reconnect and test the approved USB Wi-Fi or Ethernet adapter, then an unlisted adapter. Check the actual network connection. Use Delete for obsolete entries; use Clear only when removing the entire adapter list is intended.
The policy illustration leaves Disable USB Ethernet unchecked; select it when enabling the restriction. See USB network-adapter whitelisting for the focused workflow.
Sign in and open Control Center > USB & CD Lock. Locate Disable Android & iPhone, shown in the storage and media screenshot.
Select Disable Android & iPhone and reconnect the phone. Keep the separate Disable Mobile USB Tethering choice aligned with the network policy rather than treating it as the same control.
Attempt the normal phone file-transfer or sync workflow on this PC and separately observe charging. Data access controls are not a physical USB power switch; charging may continue while transfers are restricted.
Open Control Center > USB & CD Lock and find Disable Mobile USB Tethering. Prepare an alternate management connection for the test.
Select Disable Mobile USB Tethering, reconnect the phone, and attempt its usual USB tethering workflow. This is separate from phone file transfer.
Verify that the phone's USB connection cannot supply the restricted network access. Do not mistake another active Wi-Fi or Ethernet connection for successful USB tethering. Reverse only this setting when that connection is approved again.
Locate the control in the USB & CD Lock screenshot.
Open Control Center > USB & CD Lock and review Disable SD Card Reader. Close files open on the card before changing access.
Select Disable SD Card Reader. Keep USB disk and other media options unchanged unless those channels also need restriction.
Use a disposable test card and the actual reader or slot used at work. Check whether files can be opened or transferred under the rule. To restore reader access, clear this specific restriction and retest.
See the separate card-reader option in the storage and media screenshot.
Open Control Center > USB & CD Lock and locate the optical-drive options near the bottom. Decide whether the PC should stop reading discs, burning discs, or both.
Select Disable Reading DVD/CD to restrict reading, Disable Burning DVD/CD to restrict writing, or both when both operations must stop. A burning-only rule need not disable reading.
Use noncritical test media and the actual optical drive and burning software. Verify reading and burning separately; do not infer a successful write restriction merely because a disc is absent or the drive is unavailable.
The controls appear in the USB & CD Lock screenshot. Read block CD and DVD writing for that focused task.
Go to Control Center > Devices Lock. Review the available printer, modem, COM & LPT, infrared, Bluetooth, and 1394 categories for this workstation.
Enable the relevant Disable option, such as Disable Printer or Disable COM & LPT. A category marked Device not found is not evidence of an active, tested block.
Attempt the intended operation with the actual device, then confirm required input devices and management access still work. Clear the specific category restriction when reversing it. Phone and optical-media controls remain on USB & CD Lock.
Use the official USB Lock download and complete installation with administrator permission. Set the management password requested by the program and retain it with the person responsible for policy changes.
Open General > Password. Enter New password and Confirm password, then select Change Password. Meet the minimum length shown by the installed version; review Notify to email as appropriate.
Verify sign-in using the new password through the normal program workflow, and complete the recovery email task. Record the starting settings before applying broad device restrictions.
Sign in as the administrator and open General > Password. Locate the separate Change Email section below the password-change controls.
Review Old Email address, enter the intended New Email address, and select Change Email. Follow any confirmation requirements in the installed program and keep access to that mailbox.
Review the saved address and retain the recovery instructions with the management record. Do not assume the address is configured because a password-change notification checkbox is selected.
Both sections are visible in the Password page screenshot.
Check which USB Lock installation is involved and use the recovery email previously configured for it. Ask the responsible administrator first if a device is managed by your organization.
Follow the program's password-recovery workflow associated with that email. If the mailbox or recovery route is unavailable, contact GiliSoft Support with the version, PC, and recovery problem rather than deleting protection files.
After recovery, update the management password and recovery email through General > Password, then sign in normally. Review the relevant device policy before changing or restoring device access.
The Password screenshot shows the settings page, not a separate recovery-dialog sequence. Recovery depends on the configured route; it is not a guarantee that every forgotten password can be reset.
Review the failed-password handling choices and the separate USB disk password-dialog option. The illustrated screen describes alarms after more than five wrong entries and a ten-minute temporary login ban.
Enable the email alarm and temporary login-ban options that match the policy. Confirm the configured management email and retain a working recovery route; do not confuse these failed-password alarms with notifications for every device connection.
Review Auto pop-up the check password dialog box whenever you plug-in USB disk. Reconnect a test drive and check the chosen prompt behavior with the known management password. Avoid deliberately locking out the production administrator just to test the ban.
This standard-edition password prompt is not the same as enterprise device-specific temporary-password authorization.
Open Reports & Logs > USB Activity and enable Monitor USB when usage history is required. Review Advanced Settings for the monitoring choices available in your version.
Reconnect a disposable test drive and perform the read or write operation covered by the policy. Record the test time and device so the relevant history can be identified.
Use Refresh for USB Activity. When investigating permitted or blocked access, open the separate Allow Access or Deny Access entry under Reports & Logs.
Use Export when enabled for the records you need, and keep the version, device, time, and observed access result with them. An empty log alone does not prove a device was blocked.
Activity White List is not the storage approval list. Approve drives under Trusted Devices White-list in USB & CD Lock, and compare the records with actual device behavior.
Go to Control Center > Website Lock. Use Add under Restricting Access to specific Web sites and enter the intended site through the displayed dialog.
Check the list and test the intended website with the browser used on the PC. Use Delete for a selected unwanted entry, Clear only to remove the whole list, and Import or Export when reusing the site list.
Review Restricting changing IP address and Disable Network Adapter independently. Leave them unchanged when the goal is only to restrict selected sites or unapproved USB adapters, especially when support depends on the connection.
Go to Control Center > Program Lock and locate Restricting running specific programs.
Select Add, register the program through the displayed dialog, and attempt its ordinary launch route. Use Delete for a selected entry or Import and Export to maintain that list.
The page also provides Disable Registry Editor, Disable Task Manger, and Disable Remote Desktop Connection. Do not enable these merely to restrict one ordinary application if they are needed to maintain the PC.
Sign in as the administrator and find the relevant storage, USB Ethernet, phone, optical-media, website, or program setting. Check the matching whitelist rather than clearing unrelated protections.
Clear the specific restriction when the category should work again, or add a reviewed device exception when only that device needs access. Remove a no-longer-needed exception from the matching list when returning it to the default rule.
Repeat reading, writing, or network tests as appropriate and confirm other restrictions remain in place. If access is still denied, check separate Windows or endpoint policies instead of deleting USB Lock protection files.
For an administrator-issued temporary password tied to one device, see enterprise temporary USB access. That workflow requires enterprise customization; changing a standard whitelist entry is not automatically a timed authorization.
Reconnect an unapproved disposable drive and attempt to open a sample file and save a new sample file. Compare the result with the chosen reading and writing options.
Check both operations on the reviewed storage device, including after reconnection and restart. For network rules, compare the approved adapter and an unlisted adapter using the actual network connection.
Test phone data, tethering, card readers, and optical-media operations independently when restricted. Confirm the keyboard, mouse, required dock, and management connection still support normal work.
Sign in and confirm that the specific restriction can be reversed. Review the relevant USB Activity or access record and retain the device, time, settings, and results before applying the policy elsewhere.
| Test | Expected result |
|---|---|
| Unknown storage | Reading or writing fails according to the selected default rule. |
| Write-only restriction | A sample file opens from USB, but copying a new file to USB fails. |
| Approved company drive | The reviewed whitelist permission works after reconnection and restart. |
| Approved and unknown USB adapters | The approved adapter works; the unlisted one cannot provide the restricted connection. |
| Phone, SD card, or optical media | Each configured channel follows its own rule; test it independently. |
| Keyboard, mouse, and required dock | Ordinary input and required work remain available. |
| Recovery route | The administrator can sign in and reverse the specific restriction. |
| What you see | What to check |
|---|---|
| An approved drive is still blocked | Review the selected drive, storage permission, and default read/write rule. Reconnect it and check for a separate Windows or endpoint block. |
| A file still opens from USB | A writing-only restriction intentionally permits reading. Review Disable Reading USB Disk if reading must also stop. |
| A phone charges but files do not transfer | Check Disable Android & iPhone. Charging and data access are different behaviors; do not assume the policy failed because charging continues. |
| A storage-approved USB adapter is blocked | Register the adapter in USB Ethernet Whitelist. The storage list is not the adapter list. |
| An imported list gives an unexpected result | Compare the device identity and permission, then check the destination PC's own restrictions. The imported storage list is not a full-policy backup. |
| USB Activity is empty | Confirm monitoring is enabled, repeat the test, and refresh. Check Deny Access or Allow Access when investigating an access result. |
| The administrator password is unavailable | Use the configured email recovery route or contact Support. Do not delete protection files as a recovery shortcut. |
Yes. In USB & CD Lock, select Disable Writing to USB Disk and leave USB reading permitted. Test with a sample file: it should open from the drive, while saving a new file to that drive should fail.
Yes. Use Add under Trusted Devices White-list, select the approved drive, review Permission, and confirm with OK. Test both the approved drive and an unknown one. Also check for Windows or other endpoint policies that may separately deny access.
Yes. Use USB Ethernet Lock and its separate USB Ethernet Whitelist. Add the connected approved adapter first, then select Disable USB Ethernet. A storage whitelist entry does not also approve a network adapter.
Yes. Export the reviewed storage list from USB & CD Lock and import it on the next PC. This transfers the trusted-device list, not every USB Lock setting. Configure and verify the destination PC's restrictions separately.
USB & CD Lock has separate Disable Android & iPhone and Disable Mobile USB Tethering options. They address phone data and tethering, not a physical power switch. Check file transfer, hotspot use, and charging on the actual phone after changing the rule.
Yes. Open Reports & Logs and review Deny Access or Allow Access as appropriate. USB Activity provides a separate usage history. Enable the required monitoring, reproduce the test, and refresh the relevant view; an empty log alone does not prove the device is blocked.
Yes. USB & CD Lock includes Disable Reading DVD/CD and Disable Burning DVD/CD. Choose the restriction needed for the PC and test reading or burning with the actual drive and application.
Sign in to USB Lock and reverse the specific restriction, or add a reviewed device exception when only that device needs access. Reconnect and test again. For a forgotten password, use the recovery route associated with the configured email, or contact GiliSoft Support if recovery is unavailable.
Device-specific temporary-password authorization is available through GiliSoft USB Lock enterprise customization, not as a standard-edition workflow described here. In that deployment, the user requests a temporary password from the administrator for the identified device. Confirm access duration and how it ends during project scoping.
No. USB Lock controls device access on the configured Windows PC. It does not turn existing files into encrypted files or automatically protect them on another computer. For password-protected files on a USB drive, use an encryption workflow.
This is the full product setup guide. Use the focused articles below for a particular device, Windows scenario, or deployment task.
Set storage rules, register trusted drives and network adapters, and review access activity with GiliSoft USB Lock. Start with one PC and a verified device test.
Enter your email address to get our latest newsletter
