Select the 'Turn off Autoplay' for NoDriveTypeAutoRun to cd-rom_and_removable_media_drives Autoplay starts to read from a drive as soon as you insert media in the drive, which causes the setup file for programs or audio media to start immediately. An attacker could use this feature to launch a program to damage the computer or data on the computer. You can enable the Turn off Autoplay setting to disable the Autoplay feature. Autoplay is disabled by default on some removable drive types, such as floppy disk and network drives, but not on CD-ROM drives. Note You cannot use this policy setting to enable Autoplay on computer drives in which it is disabled by default, such as floppy disk and network drives. Counter Measure: Configure the Turn off Autoplay setting to Enabled. Potential Impact: Users will have to manually launch setup or installation programs that are provided on removable media.

[cd-rom_and_removable_media_drives/all_drives]

(1) GPO: Computer ConfigurationAdministrative TemplatesWindows ComponentsAutoPlay PoliciesTurn off Autoplay (2) REG: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDriveTypeAutoRun