People are plugging USB sticks into the reception PC

Reception and waiting-area PCs have USB ports at eye level. Visitors and couriers will plug things in, sometimes well-meant, sometimes not.

Try this first

1. 1List which PCs are publicly accessible. Reception, meeting rooms, shared printer touchscreens.
2. 2Disable USB Mass Storage class via Intune or GPO for that device group. Keyboard and mouse keep working.
3. 3For devices where visitors do need to drop files (e.g. a printer for PDFs): use a separate transfer PC, off the corporate domain, with antivirus and network isolation.
4. 4Physically block unused USB ports with port blockers if the software route is unavailable. Cheap, removes the impulse.
5. 5Tell reception what to do if someone insists. Polite refusal, email is fine.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.