Controlling Which Devices Can Be Installed by Standard Users

Applies To: Windows Server 2008

For security reasons, and by default, Windows prevents standard users from installing device drivers unless the drivers are present in the protected driver store. In some environments, an administrator might want to customize exactly which devices can and cannot be installed by a standard user.

Windows allows an administrator to prevent the installation of a device based on its device ID or device setup class. This restriction is at the device detection level. Even if the driver for the device is present in the driver store, Windows will not install devices whose device ID or device setup class is prevented by these policies.

Windows also allows an administrator to permit standard users to install devices drivers that are members of specified device setup classes.

Windows provides the following capabilities to customize what can be installed:

• Discovering Hardware IDs and Device Setup Classes for your Devices

• Allow Standard Users to Install Drivers For Devices from Specified Setup Classes

• Allow Administrators to Override Device Installation Restriction Policies

• Preventing Installation of Specific Devices

• Allowing Installation of Only Permitted Devices

• Display a Custom Message when Group Policy Prevents Device Installation