disable usb devices

I have been trying to disable usb devices and not sure what step I am missing.

I set up a startup script to change the usbstor reg key from "3" to "4".
Also used a group policy adm file to do the same thing. I've read if the
device was never installed it will work the first time.

I found another site that was telling me to assign deny permissions to the
system account on the file: c:\windows\inf\usbstor.inf and usbstor.pnf

I've done that and was able to log on as the administrator and plug in a
usb drive. The permissons were correct on those two files.

Is there something else missing? I feel as I'm close, but not sure what is
missing.

Any ideas?
.