We're running SBS 2011 and I'd like to create a GPO that disables USB storage on all of our workstations (all but two are Windows 7, the other two are XP). Is the easiest way to do this with a script or disabling it in under Group Policy Management? Along with that, how easy is it to temporarily disable it for a user that may need to copy things to a flash driver? Our users are not local admins, so if they need to copy to a flash drive can it just require an admin username/password to allow it?
Thanks.