Load/Unload Device drivers policy - what does it allow?

[Guest]

Referring to the document below for allowing Power Users to install printers:
http://support.microsoft.com/default.aspx?scid=kb;en-us;297780

What else does the Load/Unload Device Drivers policy allow the user to do
other than add printers?
Does it allow the connection of any USB device?
What about software installations.

What I want to be able to do is give Power Users access to install printers
but NOT the ability to connect USB flash drives, hard disk etc and definitely
NOT to be able to install applications.

Help appreciated.

 

[Rick \Nutcase\ Rogers]

Hi Andrew,

What else does the Load/Unload Device Drivers policy allow the user to do
other than add printers?

Exactly what the desciption implies. It allows the user to load device
drivers.

Does it allow the connection of any USB device?
Yep.

What about software installations.

Nope, but Power Users can install most software, though they are sometimes
hamstrung by programs that load (guess what?) - Device drivers.

What I want to be able to do is give Power Users access to install
printers but NOT the ability to connect USB flash drives, hard disk etc
and definitely NOT to be able to install applications.

Difficult at best to achieve using the existing policy editors, you may want
to look at this tool:
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Guest]

Hi Andrew,


Exactly what the desciption implies. It allows the user to load device
drivers.


Nope, but Power Users can install most software, though they are sometimes
hamstrung by programs that load (guess what?) - Device drivers.


Difficult at best to achieve using the existing policy editors, you may want
to look at this tool:
http://www.microsoft.com/windowsxp/sharedaccess/default.mspx

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

Thanks for the reply. Did not that power users allows most software. I tried
installs of Office and HP software and it would not allow it. Is this the
exception rather than the rule?

Is there any way of allowing printer installs under just User access rather
than Power Users?

Failing all this, is it possible to edt any settings to stop READING from an
optical drive? This would obviously stop the installation of the majority of
software.
This is a laptop so unplugging optical drive is not an option.
I found the setting to turn off writing to cd.
I can put up with the fact they can add USB devices if they must but really
want to stop both the writing to cd and especially installation of software
from cd.

 

[Rick \Nutcase\ Rogers]

Hi,

Thanks for the reply. Did not that power users allows most software. I
tried
installs of Office and HP software and it would not allow it. Is this the
exception rather than the rule?

Much depends on how the software is written. If done properly, it will need
admin rights, but much of software installs is not written properly.

Is there any way of allowing printer installs under just User access
rather
than Power Users?

Not that I know of, no.

Failing all this, is it possible to edt any settings to stop READING from
an
optical drive? This would obviously stop the installation of the majority
of
software.

"Prevent access to drives....", Run gpedit.msc, expand User Config/Admin
Templates/Windows Components/Windows Explorer

This is a laptop so unplugging optical drive is not an option.
I found the setting to turn off writing to cd.
I can put up with the fact they can add USB devices if they must but
really
want to stop both the writing to cd and especially installation of
software
from cd.

gpedit.msc, "Prevent removable media source for install", same as above
except move from WinExplorer to WinInstaller.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Guest]

Hi,


Much depends on how the software is written. If done properly, it will need
admin rights, but much of software installs is not written properly.


Not that I know of, no.


"Prevent access to drives....", Run gpedit.msc, expand User Config/Admin
Templates/Windows Components/Windows Explorer


gpedit.msc, "Prevent removable media source for install", same as above
except move from WinExplorer to WinInstaller.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

Thanks for all the help. I eventually tried the Shared Access tool on the
link you gave me originally and it seems to do most of what we wanted. In
fact very useful tool which I can see we will be making good use of in the
future!

Andrew

 

[Rick \Nutcase\ Rogers]

You're quite welcome, Andrew. I like that tool as well.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org