You could create policy to disable access to USB , if you navigate to: User Configuration->Policies->Administrative Templates->System->Removable Storage Access Then apply it for all users and create another policy which allow the members in the administrator group to have access.