AutoRun and AutoPlay¶
AutoRun executes a program automatically when removable media is inserted. AutoPlay pops up a menu offering to. Together they're how USB-borne malware spreads: plug in the drive, the malware runs. Turn both off for every drive type.
Where it is¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → AutoPlay Policies.
| Setting | Value |
|---|---|
| Turn off AutoPlay (18.10.8.3) | Enabled, All drives |
| Set the default behavior for AutoRun (18.10.8.2) | Enabled, Do not execute any autorun commands |
| Disallow AutoPlay for non-volume devices (18.10.8.1) | Enabled |
The Settings app has a simpler switch (Settings → Bluetooth & devices → AutoPlay) but it's per-user. Policy covers everyone.
Step by step¶
- Open
gpedit.msc. - Navigate to AutoPlay Policies.
- Double-click Turn off AutoPlay → Enabled → in the dropdown choose All drives → OK.
- Double-click Set the default behavior for AutoRun → Enabled → Do not execute any autorun commands → OK.
- Double-click Disallow AutoPlay for non-volume devices → Enabled → OK.
- Run
gpupdate /force.
Verify¶
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoAutorun
NoDriveTypeAutoRun should be 0xff (255, all drive types). NoAutorun should be 1.