Windows also can limit the USB devices connected (nowadays natively, I believe before third-party solutions were available), you can do things like require spec

Windows also can limit the USB devices connected (nowadays natively, I believe before third-party solutions were available), you can do things like require specific signatures on executables, ... I'd expect the big problem usually is actually defining a useful but minimal set of things allowed, so people can actually do their work. Otherwise you'll quickly get to the point of an admin overriding stuff because they need (or "need") something else, or users finding workarounds. In many cases, providing users with multiple machines of different security levels would be a useful thing to do, but is cheapened out on. E.g. I've seen companies with blanket policies of "all machines that connect to business-network X need to be locked down". And then they made an application on that network mandatory for everybody (even if its something dumb like employee time tracking), so now there are (annoying) procedures for employees that can't actually work with fully restricted machines (e.g. developers, who need to be able to install software because their job is making and testing installed software...) to circumvent the security policy, instead of giving such employees a second cheap machine to do their timesheet entry. Another example I've heard about was putting less restricted PCs with their own internet connection into control rooms. Not "needed", but it was an effective way of keeping employees who were bored out of their minds during night shifts etc from putting whatever stuff they were going to use to keep themselves entertained (movies, games, ...) on the actual control network PCs through any way they could find. Of course they weren't supposed to plug their USB drives with movies into any work PC, but it was easier to give them a safe place to do it anyways than trying to police it perfectly.