Ed Bott's Microsoft Challenge--7/27/00

Can't you just add them to the local administrator. I've found in NT 4.0 that takes care of problems such as this. We have policies in place for the network and we've never run into any problems with users being able to do any damage.

The solution might be as easy as adding the local user into the power users group on the local machine. If this is not the case you will need to find the required services in the registry and change the security attributes. You will ofcourse need touse RegEDT32 to do this unless you have a 3rd party package.

Good Luck.....Jeremy Wright

The user needs permissions to activate the device. I don't have immediate access to W2K so I can't be specific, but I would imagine there is one or more object in the active directory services to which your users need permissions. I would suggest adding those permissions to the Everyone group (or a group in which all authorized users are members).

There it goes:
Go to Control Panel, Click on Administrative Tools, Local Security Settings, Load and unload device drivers, By default, only administrator have the right, just add the user to it and reboot.

Good luck!

A small correction:
You can't do any of the above unless you're logged on with administrator's rights to the machine.
Another note, to add the user to the Load Unload Device Drivers, you can either double-click or right-click on it and select security.

Well, it seems to me the easiest thing to do would be modify your security policy. I'm not sure if you have active directory set up or not, but either way, Open up either your domain Security Policy on the AD server or Local security policy on the individual PC's and click on "user rights assignments". Scroll down until you see "Load and Unload Device Drivers". Right click on it and then check the "Define these policy settings", add the appropriate user or groups. That should allow them to load and unload USB devices without having to bother you about it.

Well The First Step Is To Be Logged In As A "Administrator" and where you have stored your security policies you should fine something like user rights assignments and once there you should see something called "Load and Unload Device Drivers". Right click on it and then check where it says ~ Define these policy settings ~ then you should add the appropriate user or groups or havever you have it all set up. Then now that should allow them to load and unload USB devices without much problems andbest of all no one has to bug you about it anymore. I've Ran Into This Problem once and it seemed to take care of it pretty well.

I have to agree with calves@cerebellum.com Date: Jul 25 2000 3:55PM
There it goes: Go to Control Panel, Click on Administrative Tools, Local Security Policy,User rights assgnment, Load and unload device drivers, add the user to it and reboot.

I don't have the answer but can tell you how to solve the problem yourself. Since only the Admin appears to be able to do it, I guessing your coming up against a permission problem of some nature.

Go to www.sysinternals.com and download their filmon and regmon tools. This tools tell you monitor registry and filesystem on a filtered basis. Run these utilities to isolate the problem.

-Craig

The permisson settings need to be set to allow non-admin access to the login script location. Be sure to review the share permissions too and if your not replicating the directory be sure to copy the script to your BDCs too.

-Craig

Well, I didn't hear you mention a BDC. Hmmm... If this is the case, then your pretty much hosed because it appears your having hardware problems with the server. I'm not sure why you'd put such dependencies on a PDC, but here is what I do to minimize the recover effort.

1. First, your BDC needs to be promoted to Primary. If your PDC is not communicating it may not be possible to promote BDC, but try it anyway. Solve this problem first, then continue.

2. Consider saving at least the following info from the PDC. a. any user profiles; b. the specific registry keys for the printer shares. The reg keys can be import on the new PDC, but the use will need to point to the new PDC though. Hmm... good reason to move to W2K, because ActiveDirectories would solve this issue.

3. Don't format the malfuncting disk, buy a new one because there will be information that will need to be recovered off it.

In the future, remove single points of failure from the system environment and your job won't be as pai

Go to www.vmware.com and buy their product or by a pair of SCSI disks and use the SCSI BIOS to control which disk you boot from. In the last solution, there will be one OS per SCSI disk.

I would reccomend seeing if that is something you could do as a power-user (don't know right off hand). You caould make them local admins , but that could cause a support nightmare when they start messing with their registry and installing unsupported software.

Assuming that that you are not using Active directory group policies you could do the following:

1.)Login as Administrator to the local computer.

2.) Access Local Computer Policy (either thru control panel or through MMC using the group policysnap in)

3.)Grant the user right Load and Unload Device Drivers to one of the following groups: Authorized Users, Users, or Everyone

You will have to do this to every computer on your network.

The problem is that by default the only group assigned this righ is the Administrators group.

If, because of security, local admin rights are unavailable to a user then the options are limited.
You mentioned notebook users. See if something like Softex PC card/bay device controller software is available for your model of machines. If it is that service can interact with the desktop and dynamically turn on or off the hardware in question. The local user also has the control from the system try or control panels.

You can first reverify the drivers are getting successfully installed. Second, you might want to consider giving the user poweruser rights. You might also consider leaving the user with the current rights and then going into the Computer Management and goto the Security policy section. There you can specifically issue individual user rights to individual processes. If not, the only other option is to give the user Administrative rights. I have installed several USB components for users with Admin rights, and haven't had any problems. I hope this helps. Also, dont forget, if you issue higher level rights, you might want to enable the Audit log.

Allow the installation of unsigned drivers in Administrative tools under local+security+settings security+options under "unsigned driver installation behavior".
Or make the user a local admin, (not recommended).

This question was auto closed due to inactivity