Member of administrators to connect a USB Flash Memory ? Why ?

[Louis Dupont]

I have some users who can not install new flash memories in their pcs since
they work with Power User privilegies and Windows XP SP2 is requesting
administrator rights everytime they connect a new device.

It says "You must be a member of Administrators in order to connect..."
whenever Cancel is pressed in the dialog that appears.

Thaks a lot in advance,
L.

 

[Nonny]

I have some users who can not install new flash memories in their pcs since
they work with Power User privilegies and Windows XP SP2 is requesting
administrator rights everytime they connect a new device.

Grant them admin privileges or learn to live with the problem.

 

[Louis Dupont]

To grant such permission is a very unprofessional aswer, mainly because this
is not standard behavior...

 

[Uwe Sieber]

I have some users who can not install new flash memories in their pcs since
they work with Power User privilegies and Windows XP SP2 is requesting
administrator rights everytime they connect a new device.

It says "You must be a member of Administrators in order to connect..."
whenever Cancel is pressed in the dialog that appears.

Probably the 'Cryptographic Services' have a problem, so
XP cannot validate its own driver's digital signature.
http://www.uwe-sieber.de/usbtrouble_e.html#xp_asks_for_drivers


Uwe

 

[Ghostrider]

To grant such permission is a very unprofessional answer, mainly because this
is not standard behavior...

What would you like for an answer? When Windows NT 4.0 was designed and
programmed, the privilege levels and limitations were also developed. The
NT product, and this includes Windows NT, Windows 2000, Windows XP, etc.,
were supposed to be managed under corporate (or business) operating rules
where the System Administrator(s) is (or are) the boss(es). This was the
standard operating procedure (SOP) for business computing in mid-1990's
and, in most business workplaces, of today.

The desire to maintain control over employees using company-owned systems
is paramount in avoiding workplace issues of improper surfing, installation
of applications, software piracy (both stealing and receiving) as well as
accidentally (or intentionally) uploading malware into the overall system.
Some ultra-conservative System Managers would prefer to lock down the
entire system and revert to "managed computing".

But common sense solutions do exist. For example, if these users need to
install flash memories, there is nothing wrong giving them administrator
privileges to an intranet that is isolated and firewall-protected from the
main system. Have you considered discussing the issues with management?

 

[Uwe Sieber]

What would you like for an answer? When Windows NT 4.0 was designed and
programmed, the privilege levels and limitations were also developed. The
NT product, and this includes Windows NT, Windows 2000, Windows XP, etc.,
were supposed to be managed under corporate (or business) operating rules
where the System Administrator(s) is (or are) the boss(es). This was the
standard operating procedure (SOP) for business computing in mid-1990's
and, in most business workplaces, of today.

The desire to maintain control over employees using company-owned systems
is paramount in avoiding workplace issues of improper surfing, installation
of applications, software piracy (both stealing and receiving) as well as
accidentally (or intentionally) uploading malware into the overall system.
Some ultra-conservative System Managers would prefer to lock down the
entire system and revert to "managed computing".

But common sense solutions do exist. For example, if these users need to
install flash memories, there is nothing wrong giving them administrator
privileges to an intranet that is isolated and firewall-protected from the
main system. Have you considered discussing the issues with management?

USB mass storage device work with drivers shipped with XP, there
is no need for admin previleges. If XP asks for such, then there
is something wrong. Give the uses admin privileges to fix this
is wrong.

 

[Ghostrider]

USB mass storage device work with drivers shipped with XP, there
is no need for admin previleges. If XP asks for such, then there
is something wrong. Give the uses admin privileges to fix this
is wrong.

I quite agree...note my last paragraph. In the particular environment
where I am located, the policy has been to establish a separate work
group or internal intranet so that these users can have administrator
privileges to the local system and workgroup but not to the domain.
It might not have been so stated as clearly.

 

[Uwe Sieber]

I quite agree...note my last paragraph. In the particular environment
where I am located, the policy has been to establish a separate work
group or internal intranet so that these users can have administrator
privileges to the local system and workgroup but not to the domain.
It might not have been so stated as clearly.

For installing new USB mass storage devices there are no admin
previleges required, neither local nor domain related.
If XP asks for admin previleges when a new simple USB drive is
attached then there is something screwed up and can be fixed.

Uwe

 

[Louis Dupont]

Sorry Sieber, it did not work neither, I also practiced Microsoft methods
1,2,3,4,5 y 9 of Microsoft's troubleshooting for USB pen drives under Windows
XP.

I'm thinking it's related to specific soft in new fujitsu laptops, i did not
format to go step by step yet, but only users of new fujitsus have report
this problem, while everybody in the network is working as Power User, with
the same enterprise standard installed programs.

Thanks a lot..

PD. I would like to have an idea of the registry entries checked when
pluging memories..

 

[Louis Dupont]

It's not only for fujitsu, I found new desktop users with the same issue.

 

[Uwe Sieber]

Could you post please the exact error message (for my records
and for investigation).

One more thing to check is filter drivers.

For an USB drive we deal with an USB device, an Disk device
and a storage volume.

The filter drivers are found in the registy under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class

Here are keys with the GUIDs of device classes.

USB devices are {36FC9E60-C465-11CF-8056-444553540000}
default: no LowFilter, no UpperFilters

Disk devices are {4D36E967-E325-11CE-BFC1-08002BE10318}
default: no LowerFilters, UpperFilters = "PartMgr"

Storage volumes are {71A27CDD-812A-11D0-BEC7-08002BE2092F}
default: no LowerFilters, UpperFilters = "VolSnap"

Try to restore these defaults, log on as restricted user
and try to attach an USB drive...


Uwe

 

[Louis Dupont]

The secret ins in the log file: C:\Windows\setupapi.log
When you plug new USB devices every event is written there.

In my case i had problems with the digital signature of
C:\WINDOWS\system32\setupapi.dll

You can use Start-Run sigverif to verify file signatures.

See Also:
http://www.raymond.cc/blog/archives...nistrator-rights-to-install-usb-flash-drives/

 

[Uwe Sieber]

Thanks for the information.


Uwe

The secret ins in the log file: C:\Windows\setupapi.log
When you plug new USB devices every event is written there.

In my case i had problems with the digital signature of
C:\WINDOWS\system32\setupapi.dll

You can use Start-Run sigverif to verify file signatures.

See Also:
http://www.raymond.cc/blog/archives...nistrator-rights-to-install-usb-flash-drives/