If they know how to re-unable it from Device manager... Then the best thing is disable it from BIOS (Usually under Integrated peripherals) and put a password to login BIOS..
by chance r u working in a institute in thummulla .
@topic - search with group policy it will b convenient. dnt knw if this will work but jst take a look @ this also Check This