New
#11
If you don't need to use them disabling USB ports is a good idea. USB keys are terrible at spreading malware.
Blocking USB Devices and Removable Media - Active Directory GPO - Spiceworks
If you need them occasionally you can sign off your normal account and onto administrator account and enable them again temporarily.