Short answer: Group Policy controls what the OS allows — but it can't show an auditor a closed port, and it doesn't run on air-gapped, OT, or visitor-facing machines. A physical USB port lock closes the port itself: in with a push, out only with the key.
Locked in ten seconds
01Push the lock into any open USB port.
02The patented latch seals the port. No contacts, no data.
03Only the matching key releases it — in seconds.
No software, no agents, no network required — which is why it works on the machines Group Policy can't reach. Full procedure in the installation guide.
Software vs. hardware, at a glance
| Method | Reversible | Visible to auditors | Air-gapped / OT |
|---|---|---|---|
| Group Policy / agent | Yes | No — proof needs log review | No — needs a managed OS |
| BIOS / UEFI disable | Yes, per machine | No — silently revertable | Unmanageable at scale |
| Epoxy / glue | No — destroys the port | Yes | Yes |
| Physical port lock | Yes — key removal | Yes — one glance | Yes — no OS needed |
They're not competitors: Group Policy covers managed Windows endpoints, physical locks cover everything else — air-gapped and OT systems, kiosks and shared PCs, Macs, printers, and switches. Auditors reviewing NIST 800-53 MP-7, CMMC 3.8.7, HIPAA §164.310, or PCI DSS 9 can verify a locked port in one glance; a locked port is the control they can photograph.
One key system, every port
Locks for USB-A, USB-C, RJ45/LAN, and more — all operated by the same key, so one keyring controls a whole facility. Browse the full range in Professional and Essential series.