USB devices for non-admins

[eejit]

I'm sure I've seen this topic before but have not been able to find it, apologies if it does exist somewhere already.

 

Basically, I need pupils/staff to be able to plug in various USB devices (webcams, intel microscope) etc. and for the device to be picked up by XP and just work.

Instead, after ghosting, those devices get 'found' again and need the drivers to be installed. So, I have to run around with every USB device and plug them into EVERY USB port as just plugging them into one does not work.

When you plug them in as a non-admin you get a login box pop-up asking for the username and password of an administrator as you need to be an admin to install the device.

I found a group policy in Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drives" which I added Everyone to as a test, but that didn't work.

 

What do you guys do - this must be a common problem?

 

Cheers.

[pete]

We do what you do (every device into every usb port) when making a ghost image for particular hardware / motherboard.

 

Of course if a dept gets shiny! new usb hardware post-ghost, it doesn't work - but that's infrequent enough to not be a major problem.

[MkII]

Don't remember seeing them eejit. There are a couple of threads on pen drives:

 

http://edugeek.net/index.php?name=Forums&file=viewtopic&t=574&highlight=USB+Drive+policy

 

http://edugeek.net/index.php?name=Forums&file=viewtopic&t=1231&highlight=USB+Drive+policy

 

Dunno if they answer your question tho'. Annoying XP doesn't remember the devices after imaging. For myself I just have the odd usb scanner so it isn't a problem.

[Geoff]

Disable driver signing checks too.

[eejit]

@ Pete. Do you have all the same hardware throughout the school? We find that ghosting doesn't keep the drivers on all machines - probably because I've checked on machines that were a different hardware type to the 'master' image and so the USB ports are new. (USB ports must have individual Device IDs or something that causes this problem in the first place)

 

@ Mark. Cheers for the reply. Had a quick look through those threads, USB sticks always get picked up fine for some reason, so not a problem with those

 

@ Geoff. yep, driver signing is switched off too.

 

As Paul once said to me "There will be an answer. let it be."

[eejit]

So, since the above group policy made no difference ( Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment >> "Load and unload device drives") I wonder what it actually does?

[pete]

@ Pete. Do you have all the same hardware throughout the school?

 

No, every main computer room (~30 machines) has identical hardware and a standard ghost. Any other machines are (usually) of the same type as a main room, so it kinda works. We generally devote a day or so to getting the ghost just as we want it (drivers etc) and then another day trying to break it - works for us, ymmv.

[eejit]

So, do you use a seperate ghost image for each room, Pete?

[pete]

So, do you use a seperate ghost image for each room, Pete?

 

Yup, though a ghost from some rooms can (sometimes works, mostly doesn't) work in other room. We tend to just do a disk -> disk copy. Takes about 5 mins per disk. After they're joined to the domain and moved to the right OU they get any other room-specific programs via group policy.

 

Our desktop ghosts (including full local install of Encarta 2005) are getting to 10GB+ so I'm loath to push them over the network.

 

This strategy does depend on you being the one who chooses the hardware - our last purchase was 8 Dells, our next purchase is 32 Dells of the same make......

[eejit]

Right, unfortunately/fortunately after 5 years of tears I've managed to get single ghost images to work on all kinds of hardware including laptops so that's where this USB device problem becomes a major pain.

[eejit]

I presume that it would be the height of bad manners to bump this question.

[DMcCoy]

I don't have any of these issues, I can take a look at my gpo settings if you want. You *are* running sysprep with ghost aren't you? I couldn't live without sysprep now

[fooby]

http://www.novell.com/coolsolutions/tools/16306.html

 

Allow Users to Install USB Jump Drives

Novell Cool Solutions: Cool Tool

 

Grant Users and Power Users the ability to install USB mass storage devices.

 

http://www.novell.com/coolsolutions/tools/downloads/allow_usb_jump_drives.zip - direct link

[eejit]

I don't have any of these issues, I can take a look at my gpo settings if you want. You *are* running sysprep with ghost aren't you? I couldn't live without sysprep now

 

Absolument.

 

Do you have webcams or that bloody Intel microscope that was everywhere 5 years ago, but that they quickly discontinued?

[eejit]

http://www.novell.com/coolsolutions/tools/16306.html

 

Allow Users to Install USB Jump Drives

Novell Cool Solutions: Cool Tool

 

Grant Users and Power Users the ability to install USB mass storage devices.

 

http://www.novell.com/coolsolutions/tools/downloads/allow_usb_jump_drives.zip - direct link

 

Cheers for the link, but it says "Grant Users and Power Users the ability to install USB mass storage devices." will that really allow users to add devices too?

Will test it shortly.

[fooby]

Well looking at what the program does it seems to grant users acccess to the INF files, the one i think it does here is USBSTOR.INF maybe this is all thats needed to be changed, and maybe there is a "USBIMG.INF" (i made that name up it isnt a real INF) maybe there are more .INF files that need full access granted to them.

 

If you read the autoit script in notepad you can sort of see what is happening.

 

HTH

[eejit]

Cheers fooby, that file didn't work, but like you, I checked what it did. I actually added "Everyone" - "Full Control" to the windows\inf folder as a test, but that didn't work

[fooby]

shame

[eejit]

Breakthrough! :idea:

 

If you put the drivers on a network share and alter the registry devicepath to point to that network share. Then, as long as the drivers are Windows Hardware Quality Labs (WHQL) supported the device will be found and added even for a pupil.

 

This is known as a server side install which is the only way to allow non-admins to add a device in XP. Thanks for the guys at Microsoft for helping me with this.

[ChrisH]

Worthy of a wiki entry or just a quick how to here id say

[ICTNUT]

@eejit :

 

Any chance of a "How To" mate, I am suffering with the same problem here and it's driving me nuts !!!!!

[Inox]

yes please, I need that info too, thanks :-)

[eejit]

Sure, it only works for Windows Hardware Quality Labs (WHQL) drivers though. That means real WHQL passed drivers - putting them in a folder labeled "WHQL" does not work as done by Logitech with their Quickcam Express drivers

 

Anyway, it's known as a server-side install:

• Make a hidden folder share on the server (\\server\drivers$)
  
• Extract your drivers to that folder so that the *.inf is in the root
  
• Open regedit on the client and browse to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion

• In the DevicePath key append the server share after a semicolon
  Example:
  Before %SystemRoot%\inf
  After %SystemRoot%\inf;\\server\drivers$
   
  

 

That should do it. BTW, I give full share and security permissions to Everyone on the driver share folder. No one knows it exists, and that way I know that the files will definitely be accessible by all.

[eean]

Hmm... would doubt it. If you open the uncompiled Autoit script in notepad- AllowUSBJumpDrives.au3 - you can see it works by giving users ' Modify, Read and Execute, Read, Write' on C:\Windows\inf\usbstor.inf. So I assume it must be a permissions problem. Perhaps you could try changing the permissions on the specific .inf files or on c:\windows\inf\ - or would that be a bit of a security risk?

 

Let us know how you get on - I've a simlar problem with digital cameras & mice etc... Seems to ask for a admin password randomly about 10% of the time.

 

I guess you already know about autoit, if you don't its great and free! http://www.autoitscript.com/

[eejit]

eean - who was your post in reply to?