Windows Forum

Ask something
Discussion Locked

User & "Install Non-PNP Printer" Right

0 helpful
15 replies

by emrahalpa 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi everybody,
I am stuck with this problem:
I have many Windows 2000 Pro laptop computers. These computers are used by regular domain users. Their domain accounts are in the local USERS group of their W2K Pro laptops. Sometimes, they have a need to install a non-PNP printer driver. They know how to do this.

The problem is, they can not install any non-PNP driver into W2K Pro, unless they are a member of the local "Power Users" or local "Administrators" group.
I tried giving the local "Users" group, the "Load and Unload Device Drivers" right. It did not work. According to the articles below, this is normal. Because, this specific right is useful when PNP hardware's drivers are being installed.

I do not want to give the users, more power than they need. This may result in unwanted software being installed on the laptops.

I do not want to make these users a member of local "Power Users" or local "Administrators" group.

Any suggestions for this problem?

Related Microsoftarticles I found:
-Non Administrator Permissions to Load and Unload Device Drivers [Q219435]
-How to Prevent Automatic Installation of Hardware in Windows [Q241367]

15 replies

by beermonster

Hi,
The first place I'd check is the spool directory under system32, In 2000 your users will be allowed to modify in this directory and subdirectories but not create - which can stop them adding the driver files. Try altering the permissions just on those directories and see if you can then install ok.....

by emrahalpa

Thanks BeerMonster, but it did not work.

I replaced the permissions on the C:\WINNT\system32\spool\ directory and all of its subdirectories, giving the local USERS group Full Control over the but it did not work out. Anyway, thanks for the suggestion.

by cportman

You have to be a member of the Power Users group to install local printers. MS created the power users to fix your problem. They still won't be able to install any software that they couldn't before being a memeber of the power users group.

cp

by emrahalpa

Thanks for the reply, but I think there must be a way. However, I agree with you on the fact that Microsoft created this group for such purposes. But it gives the user far more rights than just installing printers. Here is an excrept from the Microsoft document "Default Access Control Settings in Windows 2000" (you can jump to the last paragraph if you don't want to read all of it):

What can a Power User do that a User can??t?
A Power User can:
?h Create local users and groups.
?h Modify users and groups that they have created.
?h Create and delete non-administrator file shares.
?h Create, manage, delete and share local printers.
?h Change system time (default user right).
?h Stop or start non auto-started services.

By default, Power Users also have
?h Modify access to the Program Files directory.
?h Modify access to many locations within the HKEY_LOCAL_MACHINE\Software registry hive.
?h Write access to most system directories including %windir% and %windir%\system32.

These permissions allow Power Users to
?h Perform per-computer installation of many applications. For example, applications that do not modify Windows system files or do not modify HKEY_LOCAL_MACHINE\System.
?h Run legacy applications that improperly store per-user data in per-computer locations (without receiving error messages).

Unfortunately, these permissions are also the same permissions that allow Power Users to
?h Plant Trojan horses that, if executed by administrators or other users, can compromise system and data security.
?h Make system-wide operating system and application changes that affect other users of the system.

by beermonster

Okay, the stakes are raised ; )

Heres what I would do. Go to sysinternals.com and download both regmon and filemon (You've probably heard of sysinternals but if not they are a VERY reputable NT \ win2k resource). These two little beauties when run show EVERY file or registry key that's being accessed, as it's being accessed (IE in realtime). I'm willing to bet that your problem is registry permissions related, so log in AS A USER (not an admin) and then use RUNAS to start regmon off in an admin context. now try to add a printer, up to the point when you get the problem, and when you're done stop regmon. Now look at the results field for each key access and I bet you'll see a big fat ACCESS DENIED for every value that's giving you a headache. The beauty is that you can now open up only those specific keys (centrally via a domain gpo preferably)rather than letting your users loose as power users. This is a tried and tested method - by me : ) - that I have solved many a win2k permissions problem with. If the problem is not registry, or is a combination of registry and file, then run filemon in the same way to track file permission problems. Have fun......

by shanghai sam

Hi,
sorry for keeping waiting so long. I tried your solution, but I really could not find the exact registry setting that denied access to the printer installation. Although the logs were too big, I looked at every line.

I would be glad if you could use this method yourself. You must have much more experience in interpreting the regmon & filemon's results.

by sativocomputerservices

In my opinion, none of the above answers are correct. We encountered the same problem with our users. We do not want them to be able to install software unbeknownst to us so we made them restricted users. We then had our road warriors complain that when tehy went to a customr's site that they could not connectto their printers. It worked fine with PNP printers but not with others (Xerox and a few IBMs) The solution we came up with is rather nice. Microsoft allows administrators to edit theDRIVER.CAB file in the WINNT directory. In that file and in the DRIVER.INF file you can copy in your non PNP driver files to teh CAb file and the cut and paste teh inf from teh non PNP drivers into the DRIVER.INF file. When windows sees a matchingdevice, it will load the non PNP driver in PNP fashion. I will warn you that sometimes this does not work because of an outdated driver. Make sure you have a good current driver and a good way to distribute these two files. The CAB file holds ALLof the drivers for 2000 and is rather large. This also works for USB and Paralell devices such as scanners and cameras. The possabilities are endless with this method and more information can be found on TechNet looking for drivers.cab.

by emrahalpa

Allright, one of the best answers seems to be this. And I do not want to keep the question open longer. I am going to try your suggestion. Even if it works or not, I guess you deserve the points. Thans again.

by emrahalpa

From User Deleted on 10/03/01 04:48 PM
...
In fact that comment belongs to me. I don't know how it happened but, I wrote that reply, but User Deleted seems to have posted it. (No, I did not use his password to logon to TechRepublic.)

Emrah Alpa, the owner of the question

by gjconely

You may want to check your "Domain Security Policy" on your domain controller. Check under:
[Security Settings|Local Policies|Security Options].

Look for:
"Prevent users from installing printer driver"

by emrahalpa

That does not work, as these are stand alone workstations.
Furthermore, even if I do it on the local system security, I guess it only effects PNP printers. At least, it did not solve our problem.

by maxwell edison

Non-administrative level users require no additional permissions to install or uninstall device drivers if the device is supported hardware with a Plug and Play device ID to driver match. If you provide a properly-signed OEM driver package when using the "New Hardware Found" wizard in the case of either no match or a compatible-rank match, that signed .inf file and its related files are now present on your computer. Because of this, any subsequent "new hardware" of the same type (such as hardware-rank match in the same .inf file and using the same files) is automatically installed by Plug and Play manager without further user interaction required.

NOTE : Often devices appear as "new" to Plug and Play when they don't supply serial numbers, and so rely on location to uniquely identify themselves (such as plugging the same mouse into two different ports on a USB hub appear to use as two different mice).

You can also update drivers for a specific computer by using a specific user.At a command prompt, type runas /u: machine \administrator mmc.exe devmgmt.msc , and then press ENTER where machine is your computer name. The "runas" command permits you to run anything as the specified user, provided you have the correct password.Note that this only permits you to upgrade drivers. When a new device is found that is running in a separate process and it does not come with hardware-rank matches, it does not work because that process does not have the correct privileges. Hardware that we support "out of the box" with compatible-rank matches meaning there is more then one hardware device that uses the same device driver in the box always requires (administrative privileges) user confirmation/interaction to install. However the user can supply an OEM driver disk with a hardware-rank match signed driver package and not require administrative privileges.

by emrahalpa

Thanks for copy-pasting the reply from technet. I already said we were dealing with non-PNP printers in this case. Your reply deals with PNP printers.

This discussion is closed to new replies.