The "Custom Classes: Deny write access" machine setting should be configured correctly.
enabled/disabled
(1) GPO: Computer User Configuration\Administrative Templates\System\Removable Storage Access\Custom Classes: Deny write access
(2) Software\Policies\Microsoft\Windows\RemovableStorageDevices\Custom\Deny_Write