The "Custom Classes: Deny write access" machine setting should be configured correctly. enabled/disabled (1) GPO: Computer User Configuration\Administrative Templates\System\Removable Storage Access\Custom Classes: Deny write access (2) Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write