Turn off auto detecting of hardware. Lock down devices to the known good ones, and if they are unplugged do not allow them to re-register when re-plugged. It would be a substantial burden on the admins and with most OSes would not allow a computer to be rebooted without an admin physical review. This is not practical, but it would work for that one specific threat. That is not the only threat though: The level of effort given to secure a terminal must be weighed against the value of the breach. A more elegant solution might be an insurance policy rather than any piece of software...