Scenario 5 Block Wirte and Execute but allow specific user access and approved USB.xml

<PolicyRule Id="{83c390b6-b01e-4d83-8834-c8015a2316f2}">
    <Name>Block Wirte and Execute but allow specific user and approved USB</Name>
    <IncludedIdList>
        <GroupId>{9b28fae8-72f7-4267-a1a5-685f747a7146}</GroupId>
    </IncludedIdList>
    <ExcludedIdList>
        <GroupId>{65fa649a-a111-4912-9294-fb6337a25038}</GroupId>  <!-- exclude allowed USBs -->
    </ExcludedIdList>
    <Entry Id="{5d660ff3-a19f-47ae-8779-ca6a989d9780}"> <!-- for USBs in IncludedIdList, allow specific User or User group -->
        <Type>Allow</Type>
        <Options>0</Options>
        <AccessMask>6</AccessMask>
        <Sid>xxxxxxxx</Sid>
    </Entry>
    <Entry Id="{f9f6d219-1332-4c64-b6cb-2e14c65cd243}"> 
        <Type>AuditAllowed</Type>
        <Options>2</Options>
        <AccessMask>6</AccessMask>
        <Sid>xxxxxxxx</Sid>
    </Entry>
    <Entry Id="{07234f5c-304f-4073-a332-2434cd269816}">
        <Type>Deny</Type>
        <Options>0</Options>
        <AccessMask>6</AccessMask>
    </Entry>
    <Entry Id="{b2827dd5-db81-48d8-8cde-fb2c84a8367f}">
        <Type>AuditDenied</Type>
        <Options>3</Options>
        <AccessMask>6</AccessMask>
    </Entry>
</PolicyRule>