AutoRun and AutoPlay

AutoRun executes a program automatically when removable media is inserted. AutoPlay pops up a menu offering to. Together they're how USB-borne malware spreads: plug in the drive, the malware runs. Turn both off for every drive type.

Where it is

gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → AutoPlay Policies.

Setting	Value
Turn off AutoPlay (18.10.8.3)	Enabled, All drives
Set the default behavior for AutoRun (18.10.8.2)	Enabled, Do not execute any autorun commands
Disallow AutoPlay for non-volume devices (18.10.8.1)	Enabled

The Settings app has a simpler switch (Settings → Bluetooth & devices → AutoPlay) but it's per-user. Policy covers everyone.

Step by step

1. Open gpedit.msc.
2. Navigate to AutoPlay Policies.
3. Double-click Turn off AutoPlay → Enabled → in the dropdown choose All drives → OK.
4. Double-click Set the default behavior for AutoRun → Enabled → Do not execute any autorun commands → OK.
5. Double-click Disallow AutoPlay for non-volume devices → Enabled → OK.
6. Run gpupdate /force.

Verify

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoAutorun

NoDriveTypeAutoRun should be 0xff (255, all drive types). NoAutorun should be 1.

Try it

1. Set the autorun values, then plug in a USB drive (or mount an ISO) and watch nothing happen.
2. Find the same settings in gpedit.msc under AutoPlay Policies.

Build it

Add the autorun values to protections.bat.

Next

PowerShell Execution Policy