RIS USB Drive Access Denied

[Donald Endres]

My organization has been using Removable
USB Hard Drives for quite some time with no trouble.

For 6 months we have been testing and preparing
RIS for widespread deployment as our standard
Microsoft OS installation procedure.

The first group of computers tested in a live environment
exhibit an interesting symptom:

All users attempting to use a USB device are
prompted with driver installation prompts.
Non-administrators are eventually denied access to
whatever process is trying to make a system change.

The result is that end users can't use Removable
USB Hard Drives.

What is the system doing that users aren't aloud to do?

What could be different about a hand install and RIS
that causes trouble with Removable USB Hard Drives?

I will soon be forced to abandon RIS if the issue is not
Resolved. Any hints or tips would be greatly appreciated.

Thank you for your time,
Sincerely,
-Donald Endres

 

[NIC Student]

Hi Donald,

Have you tried adding the 3rd-party drivers to your RIS installation to see
if that helps? The following article can be adopted for video drivers, etc.
Should work for your USB drivers too, maybe it is becuase the USB2 is not
installed on the machine during your RIS. Look at this section too:

[Unattended]
DriverSigningPolicy = Ignore

How to Add OEM Plug and Play Drivers to Windows Installations
http://support.microsoft.com/default.aspx?scid=kb;en-us;254078

Do you use RIPPREP images or just the cd-based ones?

 

[Donald Endres]

Scott,

I have the following Group Policy settings in place:
Domain Users are members of the local Power User's Group
Domain Users can "Load and Unload Device Drivers"
Unsigned driver installation behavior = Silently succeed
Unsigned non-driver installation behavior = Silently succeed

I tried with and without a USB 2 driver
added to the OEM drivers folder. In both
cases I get a completely unhelpful "Access Denied"
error message when I plug in the USB drive.
I wish I could find out what thing the user is
being denied access to; or what process the user
is not aloud to cary out.

I went so far as to modify the usbstore.inf
driver file by adding a node for the driver ID
of my USB drive. This shortened the detection
process considerably, but the end result was the
same... "Access Denied" probably due to the
resulting void WHQL signature.

Sincerely,
-Donald Endres

 

[NIC Student]

I will try inquiring for you. Please give me a day or so.

I assume you are using a Win 2000 RIS server and Win2K clients, if this is
not correct, please let me know ASAP. My assumption is also that
hand-loaded Win2K clients are fine when a USB hard drive is attached but a
RIS client suffers from an "access denied" error when the same thing
happens.

 

[NIC Student]

re: Domain Users are members of the local Power User's Group
=============
You need to be an admin to install devices. Just guessing but the
inconsistency that you are seeing is likely to be the result of the manual
install being performed as local admin and installing the USB
drivers/hardware under that account. Subsequent use by PowerAdmin will
succeed because the driver was previously installed.

Are you sure that the cd-based installs do not involve setting up a usb
device so the future use of the device is ok by power users? Can you RIS a
desktop, install usb by an admin and have the machine work ok in the future
by power users?

I'm sorry but I can't think of another solution for you other than to pursue
the OEM driver issue - include them in the RIS image. I think the key point
from the following article is this sentence:

"**However the user can supply an OEM driver disk with a hardware-rank match
signed driver package and not require administrative privileges.**"

Non Administrator Permissions to Load and Unload Device Drivers
http://support.microsoft.com/?id=219435

 

[Guest]

I am another tech working on this problem and I have a twist to include in this conversation

When using RIS on a model D9540T, as soon as I log in as a user (student) I can install the USB memory stick with no prompts whatsoever
When using RIS on a model XW4100, the student user gets an access denied error when plugging in the memory stick
Of course Windows XP will allow anyone to PnP but we can't use that yet
I was told that even if we had the device drivers, every memory stick has an individual # that would cause a new user with a new usb memory stick (even if it's the same model) to go through the installation again and then receive an access denied error

Thanks

Dennis