How can you secure your computer’s hardware configuration?

You’re planning to disable the USB port on all of the computers in your organization, but you’re concerned about your end user community re-enabling the ports on individual systems. What’s the easiest way to ensure that the hardware changes are protected from any end-user modifications?