Kyle:
I had the same issue and came up with a solution that does not require third party tools and it works every time . You can do it using domain software restriction policies and specified the path and the extension to block, such as *.exe or *.bat, while allowing documents to be opened from those locations.
open the group policy management tool and navigate to
computer config
windows settings
software restriction policies (right click on it to populate the right pane)
then right click on security levels and make sure you have the "disallowed" and "unrestricted" policies. If you dont have them right click and create them.
then right click on "additional rules" and click on NEW PATH RULE. If your USBs are, let's say, in E Drive and you want to block all exe extensions, then
PATH: E:\*.exe
SECURITY LEVEL: Disallowed
and click oK.
You can add more path rules for extensions such as .bat, .vbs, etc.
You would need to restart the workstations to refresh the policy in all. The policy has to be linked and enforced in whichever OU you want to implement it in.
You can use PsTools to restart all workstations remotely. (you can get the entire list from AD)
Good luck!
