Is there a generic way in script to disable the USB ports and CDROM drive. I can disable the appropriate devices in the registry, but if the hardware changes then the tweaks don't work anymore. Can it be done at a higher level?

Now, that would be useful, as i'm building an unattended for work and as such they dislike use of USB especially.

Thanks

You can use DevCon as an alternative to Device Manager. I believe this command disables the basic (onboard) USB-controllers:

devcon disable USB\*

Edit: oh yeh, forgot the command for CDROM-drives :

devcon disable IDE\CDROM*

u can disable it in BIOS so u dont need to do anything in windows

not sure if disabling CDROM can be done in BIOS

Pain, and not easy to ensure BIOS password is set, and not all PC's have the same!!

So, as they get re-built, it will be applied.