We have a large number of workstations in our organization that I have just discovered do not, apparently, have an option in the BIOS to disable booting from devices such as USB flash drives, floppy drives, or CD/DVD drives. You can take the devices out of the default boot order so that they are not tried automatically, but anyone can hit F11 to access the boot menu during start up and manually pick one, introducing several security risks.
The PC's in question are all Systemax PC's using the AMI BIOS v.2.061.
The users of these PC's absolutely must have the ability to use CD's and DVD's, as well as flash drives, in the computers, so simply removing or disabling the devices altogether is not an option.
Is there any way at all to prevent booting from devices other than the hard drive if the BIOS does not offer such an option?