Disable AutoPlay AutoRun policies
Purpose
This purpose of this solution is to disable AutoPlay and AutoRun functionality at both system-level (HKLM) and user-level (HKCU) registry locations. It configures the following policies:
- NoDriveTypeAutoRun: Set to 255 (0xFF) to disable AutoPlay for all drive types (USB drives, optical drives, etc.)
- NoAutoPlayfornonVolume: Set to 1 to disable AutoPlay for non-volume devices
These policies prevent automatic execution of files and programs when devices are connected, enhancing system security by reducing the attack surface for malware distribution and unauthorized code execution.
Associated Content
| Content | Type | Function |
|---|---|---|
| Disable AutoPlay AutoRun Policy | Custom Field | Custom Field to enable the solution. Select this Custom Field to apply settings that disables AutoRun and AutoPlay policies across the client's Windows devices. |
| Exclude AutoPlay AutoRun Disable | Custom Field | Custom field to exclude the Site/Endpoint from AutoPlay/AutoRun disablement. |
| AutoPlay AutoRun Policies | Custom Field | This custom field is updated by the Disable AutoRun/AutoPlay Policy after it successfully disables AutoRun/AutoPlay policies on Windows machines. |
| Disable AutoPlay AutoRun Policy | Group | This contains Windows machines where the AutoPlay/AutoRun policy is set to be disabled. |
| Disable AutoPlay AutoRun Policy | Task | Disables AutoPlay and AutoRun functionality at both system-level (HKLM) and user-level (HKCU) registry locations. |
Implementation
- Create the below custom fields as per instructions provided in the documents.
- Create the group Disable AutoPlay AutoRun Policy
- Create the task Disable AutoPlay AutoRun Policy
- Schedule the task Disable AutoPlay AutoRun Policy to target the group Disable AutoPlay AutoRun Policy to start disabling the policies.
Changelog
2026-07-01
- Initial version of the document