Disable Device name Changes

[LeightonJames]

One of my schools has got an issue with pupils changing the name of the Audio Device to random words (sometimes, rather unpleasant ones) and they have asked me to disable the ability to change it.

 

The kids are accessing the device summary screen and then changing the name there so that when you hover over the volume control icon you see what they have named it to. I have done some digging around on the internet and have not found any mention of disabling this ability and was hoping someone on here would be able to shed some light on the issue.

 

Cheers

[Norphy]

Interesting!

 

My first thought would be to change the permissions of the registry key that holds that setting. Delving a little deeper into it, it appears that it's held under a GUID in

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render

 

Set the permissions in regedit so that the AD group that your students are in are denied write access to that key and hopefully that'll fix you problem. Registry permissions can be set by group policy so hopefully this ought to be relatively simple to implement

Edited May 17, 2012 by Norphy

[LeightonJames]

Awesome work Norphy!! Thanks for that!

 

I had an inkling it was to do with a registry setting so i was about to do some of my own testing but you saved me the job! Nice one!

[AngryTechnician]

I've just reproduced this here under our pupil accounts, and the complication I've found is that according to RegEdit, they don't have permission to set values in that registry key in the first place:

 

 

I ran a ProcMon trace, and the problem is that the process that sets this value in the registry it is not running under their user account. It's a svchost.exe process run under the NT AUTHORITY\LOCAL SERVICE account. I suspect denying write access to that account will cause problems.

Edited May 17, 2012 by AngryTechnician

[SYNACK]

I guess you could track down which service it is and configure it to use a different (limited) account then deny permissions to that particular user. Probably the Windows Audio service.

 

The other thing is that just locking out the write access to the specific name values rather than the whole key should not trip it up too much.

 

You could also have a scheduled tack that ran at every logon that overwrote those keys back to their correct values which would not stop them changing it but would stop it from affecting others.

[LeightonJames]

Quick update on this for those who are interested.

 

I don't have access to any GPO stuff as i'm just a lowly techie and my sys admins have just come back and said they can't do anything about it at the moment.

 

Basically our Network setup is screwed up. We are running XP and Win 7 Machines on the same domain on a Server 2003 Network. We have had to apply workarounds to allow the user accounts to work on the network in this manner and as such we cannot apply any Win 7 specific GPO changes.

 

The really bad thing about all this is due to the way the network has been setup and messed with over time is we have Domain Users (yes all of them) in the local Administrator group!! I know, Iknow. all of you now either have your head in your hands, are crying or are laughing at this ridiculous setup, but hey what can I do?? I am but a lowly techie!!

 

My AD privileges extend to password resets and moving Computers into the correct OU's!! We can't even do Software deployment via MSI's. Whilst i love my job I sometimes hate the restrictions placed upon me!!!

 

anyways, rant over. Just thought i should update you all and thanks for looking.

[cromertech]

I was going to say disable the volume control icon or system try but without GP that will be very difficult.

 

The way I allow access to the volume control is a shortcut to SndVol.exe in the start menu that just displays the mixer.

[AngryTechnician]

We started having problem with this ourselves this term and it prompted me to look into this again. My eventual solution was to set file permissions via Group Policy to add a Deny rule for our pupils group on the on %SystemRoot%\System32\mmsys.cpl

 

This control panel icon was already disabled by GP, but as others have found, you can still get to it by right-clicking on the volume control icon.

 

Basically I just replicated the existing permissions for this file in Policies\Windows Settings\Security Settings\File System and then added the Deny rule in as well. This still gives them access to the mixer via the normal system tray icon, but if they right-click and try to open Playback Devices, nothing will happen.

 

Meanwhile, Staff and admins can still access everything as normal.