An information security audit customer was using Group Policy to disable USB mass storage devices by setting the appropriate registry key from a value of 3 to 4. They verified the registry values were what they expected and moved on to other things.
After I arrived onsite and spot checked the USB restrictions on some of these workstations none of them prevented the use of my flash drive. They scratched their heads and checked the registry key and it had been changed back to a 3. If they forced a GPO update, the key was changed back to a 4 and USB mass storage devices were restricted from then on.
What was happening was these systems had never had a USB mass storage device attached. The first time one is connected, the system performs the initial installation steps, one of which sets this key to a 3 even if it was set to a 4. After reapplying the GPO, the restriction finally took effect for good.