Assuming a threat actor would not have a huge amount of resources or is a script kiddie (he could not write a 0-day but he could buy a rubber ducky); in a Windows 10 environment, if the workstation is fully patched, would disabling USB data transfer via an OS setting mitigate any serious risk?
The scenario would be "the threat actor has unsupervised access to a workstation with accessible USB ports and an open session for a few seconds".
Back in the Windows XP days USB's were spreading malware via USB autorun; afaik this era is well passed. Alternatives such as rubber duckies are the way to go. Therefore, would disabling USB data transfers mitigate anything worthy?
Context: trying to remove an old policy (disabled USB data transfers) that annoys end-users alot and probably does not mitigate much (there is full trust in employees and clicking on random files on a USB found on the parking lot is not something they would do).