Select the 'Devices: Allowed to format and eject removable media' to administrators_only This policy setting determines who is allowed to format and eject removable media. You can use this policy setting to prevent unauthorized users from removing data on one computer to access it on another computer on which they have local administrator privileges. Counter Measure: Configure the Devices: Allowed to format and eject removable media setting to Administrators. Potential Impact: Only Administrators will be able to format and eject removable media. If users are in the habit of using removable media for file transfers and storage, they will need to be informed of the change in policy. [administrators/administrators_and_power_users/administrators_and_the_interactive_user] (1) GPO: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Devices: Allowed to format and eject removable media (2) REG: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AllocateDASD oval:org.secpod.oval:def:35280 SCAP Repo OVAL Definition 2016-06-10