http://is-it-true.org/nt/nt2000/atips/atips41.shtml

That site says that you must be an admin to plug in a USB device, so if you want to use them you must be an admin, which is a pretty big security risk since if you want to use them all around a company or something since EVERYONE would have to have admin accounts, im not too sure about the truth factor on this as it seems kind of farfetched to me.

http://www.wown.info/j_helmig/w2kpolic.htm

This says:
Here you find the list of rights/privileges for all the jobs on your system, from:
- Accessing this computer from the Network
- Backup files and directories
- Restore files and directories (yes, it is a different right/privilege)
- Load and unload device drivers --> Configure hardware, reserved for Administrators.

Load and unload device drivers --> Configure hardware, reserved for Administrators

Well i guess that kind of pertains to your question as usb can fall under that, so im guessing admin is needed to use the usb, other than that i cant really find much.

Edit:

http://www.protect-me.com/dl/download.html

Device lock lets you set permissions for users trying to use the usb port and many other things. I believe theres some sort of downloadable trial version, but you have to buy the full version, some sort of method that a lot of companies use.

DeviceLock for Windows NT/2000/XP and Windows Server 2003 gives network administrators control over which users can access what devices (floppies, USB, FireWire, serial and parallel ports, Magneto-Optical disks, CD-ROMs, WiFi and Bluetooth adapters, infrared ports, ZIPs, etc.) on a local computer. Once DeviceLock is installed, administrators can control access to floppies, CD-ROMs or any other device, depending on the time of day and day of the week. DeviceLock enhances access control for Windows System Administrators and helps control removable disk usage. It can protect network and local computers against viruses, trojans and other malicious programs often injected from removable disks. Network administrators can also use DeviceLock to flush a storage device's buffers.