Configure Computer Policy to Allow Non-Administrators to Install Specific Devices

Before you can grant permission to install a specific device, you must determine the device setup class that Windows uses to uniquely identify that device. You can do this by viewing the .inf file of the device driver package, or by viewing the properties of a currently installed device.

To determine the device setup class by viewing the.inf file of a device driver package

1. Open the .inf file of device driver package in Notepad.

2. Find the section beginning with the text [Version].

3. Find the line in that section beginning with the text ClassGuid=.

4. Copy the value to the right of the equals sign to the clipboard, and then paste it anywhere it is needed.

To determine the device setup class by viewing the properties of a currently installed device

1. Install your device on a test computer.

2. Open Device Manager on that computer.

3. Find your device in the Device Manager tree.

4. Double-click your device to display the Properties page.

5. Click the Details tab.

6. In the Property list, select Device class guid.

7. Right-click the GUID, click Copy, and then paste it anywhere it is needed.

Windows supports policies that an administrator can use to control which devices can be installed by limited users. By default, only administrators can install devices. Windows enforces this policy during the staging of the device driver in the driver store. For more information about staging, see Stage a Device Driver in the Driver Store.

	Note
	This procedure is appropriate for a small number of computers. To effectively apply policy to a large number of computers, use a tool such as Group Policy. For information about Group Policy, see Group Policy on the Windows Server TechCenter (http://go.microsoft.com/fwlink/?linkid=55625).

To configure computer policy to allow a limited user to stage drivers for a specific device setup class

1. Follow the steps in one of the previous procedures to determine the device setup class GUID for your device.

2. Click Start, and then in the Start Search box, type mmc gpedit.msc, and then press Enter to run Local Group Policy Object Editor.

3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

4. In Local Group Policy Object Editor, under Local Computer Policy, double-click each of the following: Computer Configuration, Administrative Templates, System, and then Driver Installation.

5. In the details pane, double-click Allow non-administrators users to install drivers for these device classes.

6. Select Enabled to turn on the computer policy.

7. Click Show to display the current list of approved device setup classes.

8. In the Show Contents dialog box, click Add.

9. In the Add Item dialog box, enter the GUID of the device setup class including the curly braces {}, and then click OK.

10. Click OK to close the Show Contents dialog box.

11. Click OK to close the computer policy.

    In the State column, the policy is now Enabled.

Limited users on this computer (or any computer to which this policy applies) can now install devices for this device setup class without requiring any elevated rights.

	Important
	The device driver package must still be signed in accordance with computer policy. If the certificate for the driver publisher is not in the Trusted Publishers certificate store, then the user will be prompted to accept the unverified certificate during the installation process.