A hospital's imaging department keeps getting malware infections traced to USB flash drives that employees plug in from various vendors. The malware executes automatically when the drive is inserted. Without removing USB ports entirely, which measure most directly prevents this automatic execution across all department workstations?