Windows 10: Deny Write Access to Fixed Drives not Protected by BitLocker in Windows 10

You can set a policy that configures whether BitLocker protection is required for a computer to be able to write data to fixed data drives. All fixed data drives that are not BitLocker-protected will be mounted as Read-only. If the [...]

This post Deny Write Access to Fixed Drives not Protected by BitLocker in Windows 10 is from TheWindowsClub.com.

read more...

 

Bitlocker making removable media Write Protected

Check the status of the
Deny write access to removable drives not protected by BitLocker and
Deny write access to devices configured in another organization group policies. For removable drives accessed from older versions of Windows, also check the
Allow access to BitLocker-protected removable data drives from earlier versions of Windows policy.

 

Bitlocker making removable media Write Protected

Our status for Deny write access to removable drives not protected by Bitlocker is enabled. And it prompts a user to encrypt their device using bitlocker before they are permitted to write to it. It then encrypts it if the user chooses to do so, or only
allows read access. Once it is encrypted, the device is writable at that time, but once it is removed and plugged back in (To the same machine, or another machine in the same network/organization), it prompts for the password that was set. Once the password
is entered, it shows the device as being unlocked, but when you try to write to it, it says that "This disk is write protected."

 

Bitlocker making removable media Write Protected

I work for a company who handles secure data. We use bitlocker to encrypt the drives on all company machines, as well as all removable storage devices (USB Flash drives, External Hard Drives, ETC.). This works seamlessly for all built in storage, but for
removable media, it is forcing write protection on the drives after encryption, even after the drive is unlocked using the Bitlocker passcode. We still want to maintain the enforcement of encrypting anything that may contain private company data, including
all removable storage devices, but want to still be able to write to them after they are encrypted. Is this normal? Is there any way to have all removable storage devices encrypted but disable write protection once they are unlocked?

In Group Policy, our status for Deny write access to removable drives not protected by Bitlocker is enabled. When a user plugs in an external storage device, it prompts them to encrypt their device using bitlocker before they are permitted to write to it.
It then encrypts it if the user chooses to do so, or only allows read access if they refuse. Once it is encrypted, the device is writable at that time, but once it is removed and plugged back in (To the same machine, or another machine in the same network/organization),
it prompts for the password that was set. Once the password is entered, it shows the device as being unlocked, but when you try to write to it, it says that "This disk is write protected."

Additionally, if it helps, we do not push any other removable media GP bitlocker related options such as 'Deny write access to devices configured in another organization' or 'Allow access to BitLocker-protected removable data drives from earlier versions
of Windows', so it would most likely be whatever the default setting is. However, every removable media device we have tested with has been new, empty, and unencrypted until into we plug into one of our machines and encrypt with Bitlocker. Still, could adding
one of these policies (Or maybe another I am not familiar with) as 'Enabled' potentially resolve the issue?

Any help would be greatly appreciated, as I am running out of things to try, and can not find any threads where people have run into this issue.

Thanks!