Endpoint Protection

We currently have all machines set in user mode.

When SEP was installed, we moved the machines into two different groups, laptops and workstations.

This enabled us to set differing policies.

Now, we want to block USB for all users, except a couple of admins.

I convert a machine to user mode, and move this user to a group that allows USB access.

If another user logs onto the same machine, they end up in the same group that allows USB access.

Why doesn't the user go to the Default Group?

Is there any way to assign the group that new users get automatically assigned to?

You cannot switch from computer mode to user mode if the user's logon name and the computer name are already contained in any group. Switching to user mode deletes the computer name of the client from the group. It then adds the user name of the client into the group.

http://www.symantec.com/docs/HOWTO80734 

In this scenario, the users do not exist in SEPM at all. Only the computers.

When the user logs onto a "user mode machine" for the first time, it is the first time their user has ever existing in SEPM

How do other users handle the issue of applying different rules to one user?

As I see it, if i import all the users from AD, I can put them where I want.

But what if a new user joins. Where do they get put?