Restricted User

[Guest]

We need to allow restricted users the ability to add new hardware (flash
drives). I have added a group policy to allow all users to load and unload
device drivers but this didn't resolve the problem to actually allow them to
add the new hardware.

I have searched the Internet for possible solutions but no one has had an
answer yet. Please can anyone advise?

 

[Guest]

try setting them up as power users

 

[Guest]

We dont want to use power users as this then allows them to install software
etc which we have to restrict.

 

[Jon Phipps]

you may want to have a look at the shared computer tool kit from microsoft,
it allows many things to be locked and can be highly usefull in customizing
accounts. I am responsible for several student laptops and have used it on
all of them, I dont want anything done to the computer once it is
configured. The only caveat is that in the case of a domain account it has
to be locked on the DC.

Jon

 

[Steven L Umbach]

You will have to give them a recommended list of USB drives that will work
via "server side installation" that used signed drivers and has been tested
and shown to work. The link below explains more. It talks about USB
printers but the concept is the same. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;326473

Server-side Installations
A server-side installation is a device installation that is performed
entirely by the Plug and Play manager. A server-side installation can occur
only if the following conditions are true: . A bus driver detects the device
and notifies Plug and Play Manager.
. Plug and Play Manager finds an .inf file that contains a hardware ID
that matches the hardware ID of the device.
. The .inf file and the drivers for the device are signed.
. Windows XP can locate all the drivers for the device without
prompting the user for media locations (for example, the drivers are
included with the operating system, a vendor-supplied driver was previously
installed, or vendor-supplied driver files are preinstalled).
. The class installer and co-installers for the device do not open
properties at the end of the installation.
. The .inf file for the device does not indicate that the device
requires an interactive installation.
. RunOnce registry entries consist only of calls to the Rundll32.exe
file.
A server-side installation does not prompt the user for any additional
information and does not require administrator credentials. This type of
installation is known as "server-side" because the installation is performed
by Plug and Play Manager and interaction with a user-mode client is not
required.