Configuring Computer Policy to Allow Non-Administrators to Install Specific Device Setup Classes

EXERCISE 1: Configuring Computer Policy to Allow Non-Administrators to Install Specific Device Setup Classes

This exercise permits a non-administrative user to install any imaging device (such as a webcam) that has a signed driver on the Canberra computer. You first determine the GUID of the Imaging Devices setup class and then configure computer policy to permit non-administrators to install this class of device. The exercise requires that at least one device of that setup class is installed on your computer. If not, use another setup class. You need to know the procedure—the actual device setup class you choose is not important. To permit non-administrators to install a specific type of hardware device, perform the following procedure:

1. Log on to the Canberra computer with the Kim_Akers account.
2. If the Don Hall non-administrator (ordinary user) account does not already exist, create it.
3. Open Device Manager.
4. Expand Imaging Devices in the Device Manager tree. Select a device (such as a webcam).
5. Right-click the device and choose Properties.
6. On the Details tab, in the Property list, click Device Class Guid, as shown in Figure 4-23.
   
   Figure 4-23: Determining a device class GUID
7. The GUID is displayed, as shown in Figure 4-24. Right-click the GUID and choose Copy. Paste the GUID into Microsoft Notepad so you do not lose it.
   
   Figure 4-24: Monitor device type GUID
8. Click Start. Enter mmc gpedit.msc in the Start Search box and press Enter. This starts Local Group Policy Object Editor.
9. In Local Group Policy Object Editor, under Local Computer Policy, double-click Computer Configuration, double-click Administrative Templates, double-click System, and select Driver Installation.
10. In the details pane, double-click Allow Non-Administrators To Install Drivers For These Device Setup Classes, as shown in Figure 4-25.
    
    Figure 4-25: Accessing the Allow Non-Administrators To Install Drivers For These Device Setup Classes policy
11. In the Allow Non-Administrators To Install Drivers For These Device Setup Classes dialog box, shown in Figure 4-26, select Enabled.
    
    Figure 4-26: Enabling the Allow Non-Administrators To Install Drivers For These Device Setup Classes policy
12. Click Show.
13. In the Show Contents dialog box, select the text box under Value to highlight it, double-click the text box, and paste the GUID you copied earlier (including the curly braces). The Show Contents box should be similar to Figure 4-27.
    
    Figure 4-27: Pasting the GUID into the Show Contents dialog box
14. Click OK to close the Show Contents dialog box.
15. Click OK to close the Allow Non-Administrators To Install Drivers For These Device Setup Classes dialog box. Local Group Policy Editor shows the policy is Enabled.
16. If you want, stage the driver for a reputable third-party imaging device. Then log on to the Canberra computer as Don Hall and install the device. Staging a driver is described in Exercise 2.