Are you sure they are bringing it in on USB?
Another way for the miscreants to enable it is to use the APPS key on the keyboard while they have the desktop showing. This key (between right WINkey and right Ctrl on standard Dell keyboard) brings up the context menu in the same way that right-click does, and bypasses that group policy, giving them access to graphics properties to enable the shortcuts, and access to any rotation menu that may be installed with the chipset.
A second way is to press shift+f10 which does the same thing.
The only way I've found to get around this is to enter a new scancode map in registry which disables those keys:
We use the following which you can save as a .reg and run on login:
----------------------------------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layout]
"Scancode Map"=hex:00,00,00,00,00,00,00,00,06,00,00,00,00,00,5D,E0,00,00,44,00,00,00,58,00,2A,00,3A,00,2A,00,36,00,00,00,00,00
----------------------------------------------------
Description:
0000 0000 header flags
0000 0000 header version
0600 0000 no. of following entries inc null terminator
0000 5de0 maps nothing to apps (disables it)
0000 4400 maps nothing to f10 (disables it)
0000 5800 maps nothing to f12 (disables graphics shortcut)
2a00 3a00 maps left shift to caps lock (changes caps to shift)
2a00 3600 maps left shift to right shift (changes function of right shift)
0000 0000 null terminator
Changing the right shift to a left shift removes access to the filter keys shortcut (hold down right shift for 8 seconds) which is a part of accessibility options. There are various other shortcuts in accessibility which are a serious pain to maintaining computers and will cause no end of nuisance to other users if somebody fiddles with them. These options work on the current_user reg key and I've not yet found a way to script anything on a per user basis which can disable them entirely. We disable ALL shortcuts, then remove the shortcut from the start menu as well as applying this.
We use the caps lock change as our older kids have a habit of leaving caps lock on which confuses the younger ones in the next class when they try to log on and keep getting password problems. To remove it, remove the entry and edit the number of entries from 0600 0000 to 0500 0000.
The headers and null terminator are compulsory.