Can do some basic device isolation.

Add DeviceIsolation service to do the device isolation work.

The main idea now is find the particular device and its type. If it's
mass storage device, then user "Drive mapping" to do the isolation.
If it's printer, then use wmi to do the isolation.
As for any other types, use the basic acl to to the isolaiton.