we keep everything locked down, anything that requires admin elevation on windows to install requires a IS ticket, any storage you plug into the usb has to be encrypted and registered to the system to work, otherwise the ports are essentially dead. Only way to justify getting around any of it is...