We have usb devices disabled for students, enabled for staff & autorun disabled for all.

If students need to bring stuff in on a stick they bring it to us. We don't have many so this isn't a problem.