Member of administrators to connect a USB Flash Memory ? Why ?

[Guest Louis Dupont]

I have some users who can not install new flash memories in their pcs since

they work with Power User privilegies and Windows XP SP2 is requesting

administrator rights everytime they connect a new device.

 

It says "You must be a member of Administrators in order to connect..."

whenever Cancel is pressed in the dialog that appears.

 

Thaks a lot in advance,

L.

[Guest Nonny]

Re: Member of administrators to connect a USB Flash Memory ? Why ?

 

On Fri, 23 May 2008 11:03:02 -0700, Louis Dupont

<LouisDupont@discussions.microsoft.com> wrote:

>I have some users who can not install new flash memories in their pcs since

>they work with Power User privilegies and Windows XP SP2 is requesting

>administrator rights everytime they connect a new device.

 

Grant them admin privileges or learn to live with the problem.

[Guest Louis Dupont]

Re: Member of administrators to connect a USB Flash Memory ? Why ?

 

To grant such permission is a very unprofessional aswer, mainly because this

is not standard behavior...

 

 

"Nonny" wrote:

> On Fri, 23 May 2008 11:03:02 -0700, Louis Dupont

> <LouisDupont@discussions.microsoft.com> wrote:

>

> >I have some users who can not install new flash memories in their pcs since

> >they work with Power User privilegies and Windows XP SP2 is requesting

> >administrator rights everytime they connect a new device.

>

> Grant them admin privileges or learn to live with the problem.

>

[Guest Uwe Sieber]

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Louis Dupont wrote:

> I have some users who can not install new flash memories in their pcs since

> they work with Power User privilegies and Windows XP SP2 is requesting

> administrator rights everytime they connect a new device.

>

> It says "You must be a member of Administrators in order to connect..."

> whenever Cancel is pressed in the dialog that appears.

 

Probably the 'Cryptographic Services' have a problem, so

XP cannot validate its own driver's digital signature.

http://www.uwe-sieber.de/usbtrouble_e.html#xp_asks_for_drivers

 

 

Uwe

[Guest Ghostrider]

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

 

Louis Dupont wrote:

> To grant such permission is a very unprofessional answer, mainly because this

> is not standard behavior...

>

>

 

What would you like for an answer? When Windows NT 4.0 was designed and

programmed, the privilege levels and limitations were also developed. The

NT product, and this includes Windows NT, Windows 2000, Windows XP, etc.,

were supposed to be managed under corporate (or business) operating rules

where the System Administrator(s) is (or are) the boss(es). This was the

standard operating procedure (SOP) for business computing in mid-1990's

and, in most business workplaces, of today.

 

The desire to maintain control over employees using company-owned systems

is paramount in avoiding workplace issues of improper surfing, installation

of applications, software piracy (both stealing and receiving) as well as

accidentally (or intentionally) uploading malware into the overall system.

Some ultra-conservative System Managers would prefer to lock down the

entire system and revert to "managed computing".

 

But common sense solutions do exist. For example, if these users need to

install flash memories, there is nothing wrong giving them administrator

privileges to an intranet that is isolated and firewall-protected from the

main system. Have you considered discussing the issues with management?

[Guest Uwe Sieber]

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Ghostrider wrote:

>

> Louis Dupont wrote:

>

>> To grant such permission is a very unprofessional answer, mainly

>> because this is not standard behavior...

>>

>>

>

> What would you like for an answer? When Windows NT 4.0 was designed and

> programmed, the privilege levels and limitations were also developed. The

> NT product, and this includes Windows NT, Windows 2000, Windows XP, etc.,

> were supposed to be managed under corporate (or business) operating rules

> where the System Administrator(s) is (or are) the boss(es). This was the

> standard operating procedure (SOP) for business computing in mid-1990's

> and, in most business workplaces, of today.

>

> The desire to maintain control over employees using company-owned systems

> is paramount in avoiding workplace issues of improper surfing, installation

> of applications, software piracy (both stealing and receiving) as well as

> accidentally (or intentionally) uploading malware into the overall system.

> Some ultra-conservative System Managers would prefer to lock down the

> entire system and revert to "managed computing".

>

> But common sense solutions do exist. For example, if these users need to

> install flash memories, there is nothing wrong giving them administrator

> privileges to an intranet that is isolated and firewall-protected from the

> main system. Have you considered discussing the issues with management?

 

 

USB mass storage device work with drivers shipped with XP, there

is no need for admin previleges. If XP asks for such, then there

is something wrong. Give the uses admin privileges to fix this

is wrong.

[Guest Ghostrider]

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

 

Uwe Sieber wrote:

> Ghostrider wrote:

>

>>

>> Louis Dupont wrote:

>>

>>> To grant such permission is a very unprofessional answer, mainly

>>> because this is not standard behavior...

>>>

>>>

>>

>> What would you like for an answer? When Windows NT 4.0 was designed and

>> programmed, the privilege levels and limitations were also developed. The

>> NT product, and this includes Windows NT, Windows 2000, Windows XP, etc.,

>> were supposed to be managed under corporate (or business) operating rules

>> where the System Administrator(s) is (or are) the boss(es). This was the

>> standard operating procedure (SOP) for business computing in mid-1990's

>> and, in most business workplaces, of today.

>>

>> The desire to maintain control over employees using company-owned systems

>> is paramount in avoiding workplace issues of improper surfing,

>> installation

>> of applications, software piracy (both stealing and receiving) as well as

>> accidentally (or intentionally) uploading malware into the overall

>> system.

>> Some ultra-conservative System Managers would prefer to lock down the

>> entire system and revert to "managed computing".

>>

>> But common sense solutions do exist. For example, if these users need to

>> install flash memories, there is nothing wrong giving them administrator

>> privileges to an intranet that is isolated and firewall-protected from

>> the

>> main system. Have you considered discussing the issues with management?

>

>

>

> USB mass storage device work with drivers shipped with XP, there

> is no need for admin previleges. If XP asks for such, then there

> is something wrong. Give the uses admin privileges to fix this

> is wrong.

>

 

I quite agree...note my last paragraph. In the particular environment

where I am located, the policy has been to establish a separate work

group or internal intranet so that these users can have administrator

privileges to the local system and workgroup but not to the domain.

It might not have been so stated as clearly.

[Guest Uwe Sieber]

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Ghostrider wrote:

>

> Uwe Sieber wrote:

>

>> Ghostrider wrote:

>>

>>>

>>> Louis Dupont wrote:

>>>

>>>> To grant such permission is a very unprofessional answer, mainly

>>>> because this is not standard behavior...

>>>>

>>>>

>>>

>>> What would you like for an answer? When Windows NT 4.0 was designed and

>>> programmed, the privilege levels and limitations were also developed.

>>> The

>>> NT product, and this includes Windows NT, Windows 2000, Windows XP,

>>> etc.,

>>> were supposed to be managed under corporate (or business) operating

>>> rules

>>> where the System Administrator(s) is (or are) the boss(es). This was the

>>> standard operating procedure (SOP) for business computing in mid-1990's

>>> and, in most business workplaces, of today.

>>>

>>> The desire to maintain control over employees using company-owned

>>> systems

>>> is paramount in avoiding workplace issues of improper surfing,

>>> installation

>>> of applications, software piracy (both stealing and receiving) as

>>> well as

>>> accidentally (or intentionally) uploading malware into the overall

>>> system.

>>> Some ultra-conservative System Managers would prefer to lock down the

>>> entire system and revert to "managed computing".

>>>

>>> But common sense solutions do exist. For example, if these users need to

>>> install flash memories, there is nothing wrong giving them administrator

>>> privileges to an intranet that is isolated and firewall-protected

>>> from the

>>> main system. Have you considered discussing the issues with management?

>>

>>

>>

>> USB mass storage device work with drivers shipped with XP, there

>> is no need for admin previleges. If XP asks for such, then there

>> is something wrong. Give the uses admin privileges to fix this

>> is wrong.

>>

>

> I quite agree...note my last paragraph. In the particular environment

> where I am located, the policy has been to establish a separate work

> group or internal intranet so that these users can have administrator

> privileges to the local system and workgroup but not to the domain.

> It might not have been so stated as clearly.

 

For installing new USB mass storage devices there are no admin

previleges required, neither local nor domain related.

If XP asks for admin previleges when a new simple USB drive is

attached then there is something screwed up and can be fixed.

 

Uwe

[Guest Louis Dupont]

Re: Member of administrators to connect a USB Flash Memory ? Why ?

 

Sorry Sieber, it did not work neither, I also practiced Microsoft methods

1,2,3,4,5 y 9 of Microsoft's troubleshooting for USB pen drives under Windows

XP.

 

I'm thinking it's related to specific soft in new fujitsu laptops, i did not

format to go step by step yet, but only users of new fujitsus have report

this problem, while everybody in the network is working as Power User, with

the same enterprise standard installed programs.

 

Thanks a lot..

 

PD. I would like to have an idea of the registry entries checked when

pluging memories..

 

 

"Uwe Sieber" wrote:

> Louis Dupont wrote:

> > I have some users who can not install new flash memories in their pcs since

> > they work with Power User privilegies and Windows XP SP2 is requesting

> > administrator rights everytime they connect a new device.

> >

> > It says "You must be a member of Administrators in order to connect..."

> > whenever Cancel is pressed in the dialog that appears.

>

> Probably the 'Cryptographic Services' have a problem, so

> XP cannot validate its own driver's digital signature.

> http://www.uwe-sieber.de/usbtrouble_e.html#xp_asks_for_drivers

>

>

> Uwe

>

>

[Guest Louis Dupont]

Re: Member of administrators to connect a USB Flash Memory ? Why ?

 

It's not only for fujitsu, I found new desktop users with the same issue.

 

 

"Louis Dupont" wrote:

> Sorry Sieber, it did not work neither, I also practiced Microsoft methods

> 1,2,3,4,5 y 9 of Microsoft's troubleshooting for USB pen drives under Windows

> XP.

>

> I'm thinking it's related to specific soft in new fujitsu laptops, i did not

> format to go step by step yet, but only users of new fujitsus have report

> this problem, while everybody in the network is working as Power User, with

> the same enterprise standard installed programs.

>

> Thanks a lot..

>

> PD. I would like to have an idea of the registry entries checked when

> pluging memories..

>

>

> "Uwe Sieber" wrote:

>

> > Louis Dupont wrote:

> > > I have some users who can not install new flash memories in their pcs since

> > > they work with Power User privilegies and Windows XP SP2 is requesting

> > > administrator rights everytime they connect a new device.

> > >

> > > It says "You must be a member of Administrators in order to connect..."

> > > whenever Cancel is pressed in the dialog that appears.

> >

> > Probably the 'Cryptographic Services' have a problem, so

> > XP cannot validate its own driver's digital signature.

> > http://www.uwe-sieber.de/usbtrouble_e.html#xp_asks_for_drivers

> >

> >

> > Uwe

> >

> >

[Guest Uwe Sieber]

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

 

Could you post please the exact error message (for my records

and for investigation).

 

One more thing to check is filter drivers.

 

For an USB drive we deal with an USB device, an Disk device

and a storage volume.

 

The filter drivers are found in the registy under

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class

 

Here are keys with the GUIDs of device classes.

 

USB devices are {36FC9E60-C465-11CF-8056-444553540000}

default: no LowFilter, no UpperFilters

 

Disk devices are {4D36E967-E325-11CE-BFC1-08002BE10318}

default: no LowerFilters, UpperFilters = "PartMgr"

 

Storage volumes are {71A27CDD-812A-11D0-BEC7-08002BE2092F}

default: no LowerFilters, UpperFilters = "VolSnap"

 

Try to restore these defaults, log on as restricted user

and try to attach an USB drive...

 

 

Uwe

 

 

 

Louis Dupont wrote:

> It's not only for fujitsu, I found new desktop users with the same issue.

>

>

> "Louis Dupont" wrote:

>

>> Sorry Sieber, it did not work neither, I also practiced Microsoft methods

>> 1,2,3,4,5 y 9 of Microsoft's troubleshooting for USB pen drives under Windows

>> XP.

>>

>> I'm thinking it's related to specific soft in new fujitsu laptops, i did not

>> format to go step by step yet, but only users of new fujitsus have report

>> this problem, while everybody in the network is working as Power User, with

>> the same enterprise standard installed programs.

>>

>> Thanks a lot..

>>

>> PD. I would like to have an idea of the registry entries checked when

>> pluging memories..

>>

>>

>> "Uwe Sieber" wrote:

>>

>>> Louis Dupont wrote:

>>>> I have some users who can not install new flash memories in their pcs since

>>>> they work with Power User privilegies and Windows XP SP2 is requesting

>>>> administrator rights everytime they connect a new device.

>>>>

>>>> It says "You must be a member of Administrators in order to connect..."

>>>> whenever Cancel is pressed in the dialog that appears.

>>> Probably the 'Cryptographic Services' have a problem, so

>>> XP cannot validate its own driver's digital signature.

>>> http://www.uwe-sieber.de/usbtrouble_e.html#xp_asks_for_drivers

>>>

>>>

>>> Uwe

>>>

>>>

[Guest Louis Dupont]

Re: Member of administrators to connect a USB Flash Memory ? Why ?

 

The secret ins in the log file: C:\Windows\setupapi.log

When you plug new USB devices every event is written there.

 

In my case i had problems with the digital signature of

C:\WINDOWS\system32\setupapi.dll

 

You can use Start-Run sigverif to verify file signatures.

 

See Also:

http://www.raymond.cc/blog/archives/2007/11/29/windows-requires-administrator-rights-to-install-usb-flash-drives/

 

 

 

 

"Uwe Sieber" wrote:

>

> Could you post please the exact error message (for my records

> and for investigation).

>

> One more thing to check is filter drivers.

>

> For an USB drive we deal with an USB device, an Disk device

> and a storage volume.

>

> The filter drivers are found in the registy under

> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class

>

> Here are keys with the GUIDs of device classes.

>

> USB devices are {36FC9E60-C465-11CF-8056-444553540000}

> default: no LowFilter, no UpperFilters

>

> Disk devices are {4D36E967-E325-11CE-BFC1-08002BE10318}

> default: no LowerFilters, UpperFilters = "PartMgr"

>

> Storage volumes are {71A27CDD-812A-11D0-BEC7-08002BE2092F}

> default: no LowerFilters, UpperFilters = "VolSnap"

>

> Try to restore these defaults, log on as restricted user

> and try to attach an USB drive...

>

>

> Uwe

>

>

>

> Louis Dupont wrote:

> > It's not only for fujitsu, I found new desktop users with the same issue.

> >

> >

> > "Louis Dupont" wrote:

> >

> >> Sorry Sieber, it did not work neither, I also practiced Microsoft methods

> >> 1,2,3,4,5 y 9 of Microsoft's troubleshooting for USB pen drives under Windows

> >> XP.

> >>

> >> I'm thinking it's related to specific soft in new fujitsu laptops, i did not

> >> format to go step by step yet, but only users of new fujitsus have report

> >> this problem, while everybody in the network is working as Power User, with

> >> the same enterprise standard installed programs.

> >>

> >> Thanks a lot..

> >>

> >> PD. I would like to have an idea of the registry entries checked when

> >> pluging memories..

> >>

> >>

> >> "Uwe Sieber" wrote:

> >>

> >>> Louis Dupont wrote:

> >>>> I have some users who can not install new flash memories in their pcs since

> >>>> they work with Power User privilegies and Windows XP SP2 is requesting

> >>>> administrator rights everytime they connect a new device.

> >>>>

> >>>> It says "You must be a member of Administrators in order to connect..."

> >>>> whenever Cancel is pressed in the dialog that appears.

> >>> Probably the 'Cryptographic Services' have a problem, so

> >>> XP cannot validate its own driver's digital signature.

> >>> http://www.uwe-sieber.de/usbtrouble_e.html#xp_asks_for_drivers

> >>>

> >>>

> >>> Uwe

> >>>

> >>>

>

[Guest Uwe Sieber]

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

Re: Member of administrators to connect a USB Flash Memory ? Why?

 

 

 

Thanks for the information.

 

 

Uwe

 

 

Louis Dupont wrote:

> The secret ins in the log file: C:\Windows\setupapi.log

> When you plug new USB devices every event is written there.

>

> In my case i had problems with the digital signature of

> C:\WINDOWS\system32\setupapi.dll

>

> You can use Start-Run sigverif to verify file signatures.

>

> See Also:

> http://www.raymond.cc/blog/archives/2007/11/29/windows-requires-administrator-rights-to-install-usb-flash-drives/

>

>

>

>

> "Uwe Sieber" wrote:

>

>> Could you post please the exact error message (for my records

>> and for investigation).

>>

>> One more thing to check is filter drivers.

>>

>> For an USB drive we deal with an USB device, an Disk device

>> and a storage volume.

>>

>> The filter drivers are found in the registy under

>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class

>>

>> Here are keys with the GUIDs of device classes.

>>

>> USB devices are {36FC9E60-C465-11CF-8056-444553540000}

>> default: no LowFilter, no UpperFilters

>>

>> Disk devices are {4D36E967-E325-11CE-BFC1-08002BE10318}

>> default: no LowerFilters, UpperFilters = "PartMgr"

>>

>> Storage volumes are {71A27CDD-812A-11D0-BEC7-08002BE2092F}

>> default: no LowerFilters, UpperFilters = "VolSnap"

>>

>> Try to restore these defaults, log on as restricted user

>> and try to attach an USB drive...

>>

>>

>> Uwe

>>

>>

>>

>> Louis Dupont wrote:

>>> It's not only for fujitsu, I found new desktop users with the same issue.

>>>

>>>

>>> "Louis Dupont" wrote:

>>>

>>>> Sorry Sieber, it did not work neither, I also practiced Microsoft methods

>>>> 1,2,3,4,5 y 9 of Microsoft's troubleshooting for USB pen drives under Windows

>>>> XP.

>>>>

>>>> I'm thinking it's related to specific soft in new fujitsu laptops, i did not

>>>> format to go step by step yet, but only users of new fujitsus have report

>>>> this problem, while everybody in the network is working as Power User, with

>>>> the same enterprise standard installed programs.

>>>>

>>>> Thanks a lot..

>>>>

>>>> PD. I would like to have an idea of the registry entries checked when

>>>> pluging memories..

>>>>

>>>>

>>>> "Uwe Sieber" wrote:

>>>>

>>>>> Louis Dupont wrote:

>>>>>> I have some users who can not install new flash memories in their pcs since

>>>>>> they work with Power User privilegies and Windows XP SP2 is requesting

>>>>>> administrator rights everytime they connect a new device.

>>>>>>

>>>>>> It says "You must be a member of Administrators in order to connect..."

>>>>>> whenever Cancel is pressed in the dialog that appears.

>>>>> Probably the 'Cryptographic Services' have a problem, so

>>>>> XP cannot validate its own driver's digital signature.

>>>>> http://www.uwe-sieber.de/usbtrouble_e.html#xp_asks_for_drivers

>>>>>

>>>>>

>>>>> Uwe

>>>>>

>>>>>