Windows – Permission to enable\disable devices in device manager without admin rights

active-directorydriversgroup-policywindowswindows 7

Short question: Can you use group policy to allow users to disable\enable devices without giving them full administrative rights to a machine?

More detailed: We have machines that crash on logoff\reboot when using a serial to usb adapter. The serial device was never designed to be abruptly disconnected by USB and it causes the OS to hang.

The fix was to write a program to detect logoff\reboot, block it them, disable the serial device, and then proceed to logoff. It works great with the exception that I have to grant users admin rights to the Windows machine.

Best Answer

I learned that

Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Load and unload device drivers

Is the GPO that determines this.

Everything is running stable now

Related Solutions

Windows – Useful Command-line Commands on Windows

A little known one is

getmac

It shows the MAC address(es) of your network adapter(s).

Screenshot of running getmac from a Windows commandline window.

When do you really need an organizational unit in Active Directory

In general OUs are used for:

Keeping things clean and structured. Your users are kept away from groups, your groups are kept away from computers, objects in site A are kept away from objects in site B, and so on.
Delegation of control. Only really needed if you have multiple levels of access or multiple sites with different admins in each. Even so I would plan ahead and set things up to enable it anyway.
Group policies. Not totally necessary as policy application can be managed via either permissions or WMI filters, but all the same it helps to know that if a user is in OU X they get policy Y.

Note that in the above you cannot apply a GPO to a container, so if you don't create OUs you will have to set all of your GPOs at top (Domain) level and filter them using either WMI or security. It's easier for you and for everyone else to just use OUs except for if you have a scenario where the specific policies you want/need cannot be done (or can be done but are messy) using an OU model.

Aside from the obvious technical requirements in my last 2 points, I think that keeping things clean and tidy is reason enough. It's easier to find the object you want out of a list of 100 than it is to find it out of a list of 1500, for example. It also separates the objects you create (users, computers and groups, mostly) from builtin objects, which can help to prevent nasty accidents ("OK, who deleted the Administrator account?").

Best Answer

Related Solutions

Windows – Useful Command-line Commands on Windows

When do you really need an organizational unit in Active Directory

Related Topic