but I do have a solution' Don't stand on the soapbox about how you were right, but use this as a case study to show WHY you need to have a solution in place, and use it to your advantage. and re enforce your idea to get them thinking.

Īgain, this all depends on how well you can convince them that you need budget to do this, given that it just happened, it's best to use this exact reason. Not cheap, but does give you a ton of flexibility in a enterprise environment, and security that you want, including authorizing only what drives you want, disable / enable ports, and writing to the windows event log of what data goes to what device (software records both the user, and the SID of the device it went to). Also the makers of the awesome enterprise friendly self encrypting hard drives & flash drives. Software solution - The professional way & expensive way, SecRMM made by Squada Technologies. It will stop the drives themselves from ever being usable on the machines, unless someone is sneaky enough to bring in that exact model flash drive. This can be a bit of a help-desk / complainant dept thing, but then again, you don't get something for nothing, this is a free choice after all, and it lets them keep drives that are already installed before you make the GPO change. It only works though given your users don't have admin rights, and you don't have a lot of people bringing in devices all the time.

Disable driver installation - By far the cheap & easy fix, like adding ducktape to a leaking boat, but it does work if your security is in place.Rubicon4115 - There is actually two ways of doing what you are wanting, I've done them both, having worked for a pig headed management staff too.

Usb security