Deny all removable storage access

Removable devices are susceptible to viruses and malware, and enabling users to plug them into their computers can infect your entire network. Removable devices also allow bad actors to remove large amounts of data in a short time. You can prohibit the use of removable devices by enabling the All Removable Storage classes: Deny all access policy.User Configuration > Administrative Templates > System > Removable Storage Access