How to prevent a regular / limited user from installing USB driver?

[Stuckfree]

How to prevent a regular / limited user from installing USB driver?

 

[Madhur B]

Hi Stuckfree,

Here is the link through which you can allow a limited user to stage drivers for a specific device: Configure Computer Policy to Allow Non-Administrators to Install Specific Devices

Below given link have steps to Allow or Deny All Access to Removable Drives: http://www.vistax64.com/tutorials/180395-removable-drives-allow-deny-all-access.html

Please perform the steps mentioned in the above links and post the results.

 

[Stuckfree]

Hi Madhur B ,

Thanks for the link,
The link information is good however is related on how to enable a limited users to install USB or any othere devices drivers, but what i want is to prevent a regular / limited user from installing USB driver?

I am not sure about a limited / regular user account cannot install external devices driver by default, however each time when i installed a USB driver from an administrator account and then log off and log on to a limited / regular user account i can access to USB devices. My point is prevent a limited / regular from accessing an external devices such as: USB, ect..

 

[Madhur B]

Hi Stuckfree,

Follow the instructions in the link mentioned below to check if the issue gets resolved: How Do I Restrict Guests From Accessing a Drive? | eHow.com

NOTE: Before you perform the steps ensure to back-up the registry, in case you want to revert.

Please post the results.

 

[Stuckfree]

Hi Madhur B ,
That mean i need to format all my USB drive with NTFS format otherwise won't work. Is there any other method without the need to format all USB format to NTFS format?

Oh, by the way the link was a good solution.
Thanks

 

[Madhur B]

Hi Stuckfree,

We can try with the follow link and check if it works: How to Restrict File Access on a Fat File System With Windows XP Professional | eHow.com

Please perform the steps mentioned in the above links and post the results.

 

[Stuckfree]

Hi Madhur B,

I think the website has posted a wrong title:

How to Restrict File Access on a Fat File System With Windows XP Professional

There's no "Security" tab in a FAT formated USB drive or any folder / files in c:\ drive.

 

[townsbg]

Try this: start menu > control panel > administrative tools > Local security policy. On that window under local policies select security options. Find and double click on User account control: behavior of the elevation prompt for standard users. In the drop down change to automatically deny elevation requests.

I am not sure how much that will help because many drivers for USB devices don't require user interaction for installation. There are 3rd party tools that prevent users from making permanent system changes except for someone who knows how to log into the system bypassing the software. See this: Windows SteadyState - Wikipedia, the free encyclopedia

This wiki is about tools that microsoft no longer has available however there are alternatives listed such as deep freeze. You can probably still find a download for windows steady state through file sharing sites just keep in mind that such files can be contaminated with viruses. Keep in mind that if you go this route documents stored on such protected drives won't be saved so you might want to have an alternative hard drive or partition that is unprotected by the software for storing documents. I recommend that you perform a new install when you set it up and that you if possible test the software on a system that you aren't using. The college that I went to used deep freeze on publicly available systems and any changes that we made where wiped out upon reboot.

 

[Stuckfree]

Hi townsbg,

Because many drivers for USB devices don't require user interaction for installation.
That's why even though i didn't install any USB driver in an administrator account and still be able to install USB driver in a regular / limited user account after plugged in USB.

So there's no solution that you know to prevent regular / limited from installing driver?

Couldn't find User account control in start menu > control panel > administrative tools > Local security policy>local policies >security options

 

[townsbg]

You didn't install the drivers rather they where installed when windows was installed. All that windows does is select the most appropriate driver for the device and as far as I know there is no way to stop it. Depending upon your device you might have the option of disabling USB ports on the BIOS settings (see your manual).

 

[Stuckfree]

Hi townsbg ,

You didn't install the drivers rather they where installed when windows was installed.
But each time when i log on to a regular / limited user account and plug in the USB to pop-up in taskbar a message: A new device is installing or something like thing, can't remember what exact message it is.


Depending upon your device you might have the option of disabling USB ports on the BIOS settings (see your manual).

However, is this solution prevent no just a regular / limited user account also among all others users including an administrator account right?

 

[Stuckfree]

Hi townsbg ,

But each when i plug in the USB into my computer to pop-up a message in the taskbar saying is installing a driver.



you might have the option of disabling USB ports on the BIOS settings (see your manual).

This solution, may affect all users account too including the administrator right?

 

[townsbg]

Disabling the ports would affect everyone however you would be able to enable it when needed. When windows says that it is installing a driver it is selecting the best driver among those already on your computer and matching it to your device so essentially all it is doing is setting up windows to use the device. Think about this: if the driver isn't already on your computer then you would either need to allow windows to connect to the internet to download it or install it from an executable that you either downloaded from the internet or what comes on a cd. Now user account control should prompt for a password when installing from an executable or a cd however I don't know of a way to stop windows from setting up a driver that is already there.