While Vista includes new Group Policy settings that let you prevent device installation based on device setup class GUID or PnP device ID, this may not be sufficient in a highly secure environment. If you want to prevent Vista from installing *any* new devices, you can do this using local Group Policy as follows:
1. Type gpedit.msc in the Start Search box and hit Enter.
2. Click Continue when the UAC prompt appears.
3. Navigate to the following policy location:
Computer Configuration\Administrative Templates\System\Device Installation Restrictions
4. Enable the following policy setting:
Prevent installation of devices not described by other policy settings
Note that when this policy setting is enabled it will also prevent existing devices from having their drivers updated. Note also that you can selectively override this policy for specific device setup class GUIDs and PnP device IDs by enabling and configuring the following two policy settings which are found in the same location:
Allow installation of devices using drivers for these device classes
Allow installation of devices that match any of these device IDs.
Cheers,
Mitch Tulloch, MVP
http://www.mtit.com
