Re: Non-admin installation of hardware

Zak Kebron <ZakKebron@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
Hi Shenan,

Thanks for your reply. Is there any way (short of making the user a
Local Admin / Admin group member) to permit the user to install new
hardware? I've tried setting the "Load and Unload Device Drivers"
user right
(http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/543.mspx?mfr=true)
in GPEdit to a non-admin userID, but to no effect. Thanks again for
your help!

Pardon my jumping in, but why would you want a non-admin to be able to
install *anything* ?



- Zak

"Shenan Stanley" wrote:

Zak Kebron wrote:
I have a question about the ability of non-administrator accounts
to add new hardware. From the Knowledge Base
(http://support.microsoft.com/default.aspx?scid=kb;en-us;326473) I
see that "For security reasons, Windows XP cannot permit a user who
is not an administrator to install a device on the computer."
However, when I go to my local library, sit down in front of one of
their shared desktops, and pop in a USB drive, it gets recognized
and installs. I'm about 99% certain that the libraries don't give
these "shared" logins Local Administrator rights, so how is this
happening?

USB thumb drives - in most cases (non-U3 essentially) require no
special drivers/software in order to be used.
Therefore - the user does not have to install anything/update
anything special in order to gain access to the resource.

If the driver is already in place, they (the user) are not installing
anything.

It's like if you go to their computer as an administrator and
install a USB scanner (driver, software, etc) and leave... If you
did it correctly - even if they disconnect their system, unplug
everything and come back later - they won't need you (if they can
connect tab A into slot B) - and they will still be able to utilize
the hardware in question.

However - it is highly likely that if you just handed the user
(without admin rights) the scanner and let them try to install it -
they'd fail - as most scanners/printers will not already have the
drivers/software pre-installed.

Similar - not exact - to what is going on.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html



.

Relevant Pages

  • Re: Deny Interactive Logon but Allow Runas
    ... users may also need to install a fix-pack, ... be an admin to install. ... if your secret app is really so bad ... As our users don't have local admin rights they usually have ...
    (microsoft.public.windowsxp.security_admin)
  • RE: Office tries to repair/reinstall
    ... Giving admin rights to everyone is not the solution. ... The file association issue should be also related to the Office 2007 installation. ... I will check the registry and install windows installer. ...
    (microsoft.public.office.setup)
  • RE: Administrator Rights?
    ... but the "run as" secondary logon is sufficient. ... Someone with Admin credentials does not have to be the primary logon for the ... updates to fire and install. ... Windows update will not install ANY update if the Admin is not logged on. ...
    (Security-Basics)
  • Re: Client Installation Issues: SMS 2.0 SP5
    ... Log on locally as LOCAL admin and install. ... Log on Locally as domain user who has LOCAL admin rights. ... The SMS Service account IS a domain admin ...
    (microsoft.public.sms.setup)
  • Re: Getting frustrated
    ... > after I had given her user name admin privileges. ... > between the user accounts. ... I'd like for her to be able to install and uninstall ... > I have another workstation to set up that is XP Pro. ...
    (microsoft.public.windowsxp.security_admin)