So googled through inet and…tried to think myself …1)set usbstor.inf and usbstor.sys FULL CONTROL security to DENY for SYSTEM account 2)Removed User account from Administrators (??? on R90LEW). Now all “new hardware found” displays login dialog to get Administartor account and (it seems or not?) only devices with already installed drivers can be attached. So it seems that only allowed devices can be made active. Any drawbacks? Thanks