I need to do the following on a Windows 2000 workstation:
A) Forbid the execution of any executable file from a USB flash drive (not just .msi), regardless of which drive letter it mounts on, but not prohibit access to other data.
B) I would prefer to do this via Active Directory Policy push
C) I don't want to disable all use of the usb drive (via disabling drivers, etc) - I still need to allow read/write access to documents.
D) I *don't* want to prohibit executable access via CD-ROM