How can Everyone or PowerUser add a USB Pen Drive?

[mlbasso]

Is there a way to allow Everyone or PwowerUser to add hardware (i.e. USB Pen Drive)? I do not want to make them a local administrator.

 

[bcastner]

Only if the device is PnP.
You can then allow Power Users to add or remove device drivers, and act as part of the operating system.

In the main, the anser is no.

There has to be a revision of GPOs to handle these USB devices, but at the moment there is not, other than using a very relaxed security template, or making them Administrators.

 

[mlbasso]

Thanks bcaster,
On more thing...
When you say "only if the device is PnP", does that mean there is a difference between which Pen drives I can buy? Some are PnP and some are not?

 

[bcastner]

Let me restate things, as what I posted above is not as clear as I intended.

From a Windows security perspective, a new device can be installed either in a "client-side" or "server-side" context.

A client-side installation requires client installation software (for example, the Add Hardware Wizard, the Found New Hardware Wizard, or a vendor-supplied device installation program). The client software uses the Setup application programming interface (API) to install the device, and the Setup API uses services provided by Plug and Play Manager as required.

A server-side installation does not prompt the user for any additional information and does not require administrator credentials. This type of installation is known as "server-side" because the installation is performed by Plug and Play Manager and interaction with a user-mode client is not required.

To force the first type of installation, client-side, you need to satisfy both security requirements and software needs to allow the PnP manager (which runs in the System context) to do the task without user interaction.

Non-administrative level users require no additional permissions to install or uninstall device drivers if the device is supported hardware with a Plug and Play device ID to driver match. If you provide a properly-signed OEM driver package when using the "New Hardware Found" wizard in the case of either no match or a compatible-rank match, that signed .inf file and its related files are now present on your computer. Because of this, any subsequent "new hardware" of the same type (such as hardware-rank match in the same .inf file and using the same files) is automatically installed by Plug and Play manager without further user interaction required.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;219435

So by making sure the workstation has installed the .inf required by the device, making certain all drivers are signed, making sure the device supplied a PnP serial ID, would permit the non-administrator user to install the device without Administrator credentials.

As a practical measure, install the device with user interaction as administrator (or use RunAs). Then remove the device and try again in a user context and on a different USB port. If the device firmware (or user installed software) is sufficiently Windows aware, the needed .inf files should then exist on the user machine and no administrator access should be necessary.

Please read the link to the MS KB above for further details.