Installing driver in user mode

Hi,
I know that it's typically impossible to install driver with user
priviledges, but I've heard that using MSI would enable this.
Anybody care to clarify?

cheers

Arkady
Thu Aug 04 06:16:55 CDT 2005

They add "SeLoadDriverPrivilege" to the user account

Arkady

"Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
> Hi,
> I know that it's typically impossible to install driver with user
> priviledges, but I've heard that using MSI would enable this.
> Anybody care to clarify?
>
> cheers

pavel_a
Thu Aug 04 05:31:04 CDT 2005

"Kenny Liew" wrote:
> Hi,
> I know that it's typically impossible to install driver with user
> priviledges, but I've heard that using MSI would enable this.
> Anybody care to clarify?
>

MSI has a general way to let user install system level components.
Basically it runs it's own service that does such things on user behalf.
AFAIK whether or not MSI is alowed to do this, can be regulated thru policies.

--PA

KennyLiew
Thu Aug 04 05:43:02 CDT 2005

Thanks Arkady...
What I'm after is of a more generic user approach, i.e. I wouldn't know if
an administrator has added the priviledge to the user acc, so I have to
assume that they don't have the load driver priviledge.

On Pavel's reply, does that mean MSI will only work if the user already has
the priviledge set prior to the install?

cheers

"Arkady Frenkel" wrote:

> They add "SeLoadDriverPrivilege" to the user account
>
> Arkady
>
> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
> news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
> > Hi,
> > I know that it's typically impossible to install driver with user
> > priviledges, but I've heard that using MSI would enable this.
> > Anybody care to clarify?
> >
> > cheers
>
>
>

Arkady
Thu Aug 04 07:29:25 CDT 2005

I didn't yet see Pavel's answer when I answered and absolutely agree with
him.
You can view how to do that on
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secbp/security/changing_privileges_in_a_token.asp
( aware of wrap )
Arkady

"Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
news:DD7333D5-64D1-4383-8169-12B977277FA6@microsoft.com...
> Thanks Arkady...
> What I'm after is of a more generic user approach, i.e. I wouldn't know if
> an administrator has added the priviledge to the user acc, so I have to
> assume that they don't have the load driver priviledge.
>
> On Pavel's reply, does that mean MSI will only work if the user already
> has
> the priviledge set prior to the install?
>
> cheers
>
> "Arkady Frenkel" wrote:
>
>> They add "SeLoadDriverPrivilege" to the user account
>>
>> Arkady
>>
>> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
>> news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
>> > Hi,
>> > I know that it's typically impossible to install driver with user
>> > priviledges, but I've heard that using MSI would enable this.
>> > Anybody care to clarify?
>> >
>> > cheers
>>
>>
>>

pavel_a
Thu Aug 04 11:58:07 CDT 2005

No, I actually meant this
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/msi/setup/installing_a_package_with_elevated_privileges_for_a_non-admin.asp?frame=true

Regards,
--PA

"Arkady Frenkel" wrote:
> I didn't yet see Pavel's answer when I answered and absolutely agree with
> him.
> You can view how to do that on
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secbp/security/changing_privileges_in_a_token.asp
> ( aware of wrap )
> Arkady
>
> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
> news:DD7333D5-64D1-4383-8169-12B977277FA6@microsoft.com...
> > Thanks Arkady...
> > What I'm after is of a more generic user approach, i.e. I wouldn't know if
> > an administrator has added the priviledge to the user acc, so I have to
> > assume that they don't have the load driver priviledge.
> >
> > On Pavel's reply, does that mean MSI will only work if the user already
> > has
> > the priviledge set prior to the install?
> >
> > cheers
> >
> > "Arkady Frenkel" wrote:
> >
> >> They add "SeLoadDriverPrivilege" to the user account
> >>
> >> Arkady
> >>
> >> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
> >> news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
> >> > Hi,
> >> > I know that it's typically impossible to install driver with user
> >> > priviledges, but I've heard that using MSI would enable this.
> >> > Anybody care to clarify?
> >> >
> >> > cheers
> >>
> >>
> >>
>
>
>

Maxim
Thu Aug 04 14:41:55 CDT 2005

Signed PnP driver packages are installed by the PnP service automatically
at device insert, and there is no need in admin logon for this.
Any other driver packages - yes, require admin rights (so is - any software
installs in fact).

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
> Hi,
> I know that it's typically impossible to install driver with user
> priviledges, but I've heard that using MSI would enable this.
> Anybody care to clarify?
>
> cheers

KennyLiew
Fri Aug 05 11:15:04 CDT 2005

right... what happens if it was just a pure software driver - hence no
hardware present to invoke that PnP notification?
can we do auto install using an exe - which would then invoke MSI?

cheers,
Kenny

"Maxim S. Shatskih" wrote:

> Signed PnP driver packages are installed by the PnP service automatically
> at device insert, and there is no need in admin logon for this.
> Any other driver packages - yes, require admin rights (so is - any software
> installs in fact).
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
> news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
> > Hi,
> > I know that it's typically impossible to install driver with user
> > priviledges, but I've heard that using MSI would enable this.
> > Anybody care to clarify?
> >
> > cheers
>
>
>

Pavel
Fri Aug 05 18:44:52 CDT 2005

"Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message news:1D4C3438-73C9-42E4-A57C-B19D4DCBEE51@microsoft.com...
> right... what happens if it was just a pure software driver - hence no
> hardware present to invoke that PnP notification?
> can we do auto install using an exe - which would then invoke MSI?

Yes you can.

--PA

Arkady
Sat Aug 06 12:42:55 CDT 2005

Pavel , I'm almost sure that MSI use ( in the link you show ) methods
from link I mention :)
Arkady

"Pavel A." <pavel_a@NOwritemeNO.com> wrote in message
news:56A119E8-FE8B-4EC4-B3BF-9EF0A18B978C@microsoft.com...
> No, I actually meant this:
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/msi/setup/installing_a_package_with_elevated_privileges_for_a_non-admin.asp?frame=true
>
> Regards,
> --PA
>
> "Arkady Frenkel" wrote:
>> I didn't yet see Pavel's answer when I answered and absolutely agree with
>> him.
>> You can view how to do that on
>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secbp/security/changing_privileges_in_a_token.asp
>> ( aware of wrap )
>> Arkady
>>
>> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
>> news:DD7333D5-64D1-4383-8169-12B977277FA6@microsoft.com...
>> > Thanks Arkady...
>> > What I'm after is of a more generic user approach, i.e. I wouldn't know
>> > if
>> > an administrator has added the priviledge to the user acc, so I have to
>> > assume that they don't have the load driver priviledge.
>> >
>> > On Pavel's reply, does that mean MSI will only work if the user already
>> > has
>> > the priviledge set prior to the install?
>> >
>> > cheers
>> >
>> > "Arkady Frenkel" wrote:
>> >
>> >> They add "SeLoadDriverPrivilege" to the user account
>> >>
>> >> Arkady
>> >>
>> >> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
>> >> news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
>> >> > Hi,
>> >> > I know that it's typically impossible to install driver with user
>> >> > priviledges, but I've heard that using MSI would enable this.
>> >> > Anybody care to clarify?
>> >> >
>> >> > cheers
>> >>
>> >>
>> >>
>>
>>
>>

Pavel
Sat Aug 06 18:32:26 CDT 2005

"Arkady Frenkel" <arkadyf@hotmailxdotx.com> wrote in message news:e$XHhYqmFHA.764@TK2MSFTNGP14.phx.gbl...
> Pavel , I'm almost sure that MSI use ( in the link you show ) methods from link I mention :)
> Arkady

Almost, you say? Then please look on your XP machine for a service MSIServer.
It's description is "Adds, modifies, and removes applications provided as a Windows Installer (*.msi) package"
and it runs as LocalSystem. What you think it does?
--PA


> "Pavel A." <pavel_a@NOwritemeNO.com> wrote in message news:56A119E8-FE8B-4EC4-B3BF-9EF0A18B978C@microsoft.com...
>> No, I actually meant this:
>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/msi/setup/installing_a_package_with_elevated_privileges_for_a_non-admin.asp?frame=true
>>
>> Regards,
>> --PA
>>
>> "Arkady Frenkel" wrote:
>>> I didn't yet see Pavel's answer when I answered and absolutely agree with
>>> him.
>>> You can view how to do that on
>>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secbp/security/changing_privileges_in_a_token.asp
>>> ( aware of wrap )
>>> Arkady
>>>
>>> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
>>> news:DD7333D5-64D1-4383-8169-12B977277FA6@microsoft.com...
>>> > Thanks Arkady...
>>> > What I'm after is of a more generic user approach, i.e. I wouldn't know if
>>> > an administrator has added the priviledge to the user acc, so I have to
>>> > assume that they don't have the load driver priviledge.
>>> >
>>> > On Pavel's reply, does that mean MSI will only work if the user already
>>> > has
>>> > the priviledge set prior to the install?
>>> >
>>> > cheers
>>> >
>>> > "Arkady Frenkel" wrote:
>>> >
>>> >> They add "SeLoadDriverPrivilege" to the user account
>>> >>
>>> >> Arkady
>>> >>
>>> >> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
>>> >> news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
>>> >> > Hi,
>>> >> > I know that it's typically impossible to install driver with user
>>> >> > priviledges, but I've heard that using MSI would enable this.
>>> >> > Anybody care to clarify?
>>> >> >
>>> >> > cheers

Arkady
Sun Aug 07 02:42:36 CDT 2005

CreateRestrictedToken() for user
Arkady

"Pavel A." <pavel_a@NOwritemeNO.com> wrote in message
news:uDlqf8tmFHA.2444@tk2msftngp13.phx.gbl...
> "Arkady Frenkel" <arkadyf@hotmailxdotx.com> wrote in message
> news:e$XHhYqmFHA.764@TK2MSFTNGP14.phx.gbl...
>> Pavel , I'm almost sure that MSI use ( in the link you show ) methods
>> from link I mention :)
>> Arkady
>
> Almost, you say? Then please look on your XP machine for a service
> MSIServer.
> It's description is "Adds, modifies, and removes applications provided as
> a Windows Installer (*.msi) package"
> and it runs as LocalSystem. What you think it does?
> --PA
>
>
>> "Pavel A." <pavel_a@NOwritemeNO.com> wrote in message
>> news:56A119E8-FE8B-4EC4-B3BF-9EF0A18B978C@microsoft.com...
>>> No, I actually meant this:
>>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/msi/setup/installing_a_package_with_elevated_privileges_for_a_non-admin.asp?frame=true
>>>
>>> Regards,
>>> --PA
>>>
>>> "Arkady Frenkel" wrote:
>>>> I didn't yet see Pavel's answer when I answered and absolutely agree
>>>> with
>>>> him.
>>>> You can view how to do that on
>>>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secbp/security/changing_privileges_in_a_token.asp
>>>> ( aware of wrap )
>>>> Arkady
>>>>
>>>> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
>>>> news:DD7333D5-64D1-4383-8169-12B977277FA6@microsoft.com...
>>>> > Thanks Arkady...
>>>> > What I'm after is of a more generic user approach, i.e. I wouldn't
>>>> > know if
>>>> > an administrator has added the priviledge to the user acc, so I have
>>>> > to
>>>> > assume that they don't have the load driver priviledge.
>>>> >
>>>> > On Pavel's reply, does that mean MSI will only work if the user
>>>> > already
>>>> > has
>>>> > the priviledge set prior to the install?
>>>> >
>>>> > cheers
>>>> >
>>>> > "Arkady Frenkel" wrote:
>>>> >
>>>> >> They add "SeLoadDriverPrivilege" to the user account
>>>> >>
>>>> >> Arkady
>>>> >>
>>>> >> "Kenny Liew" <KennyLiew@discussions.microsoft.com> wrote in message
>>>> >> news:D935FB1C-FC84-4E8C-879A-F463C92FB438@microsoft.com...
>>>> >> > Hi,
>>>> >> > I know that it's typically impossible to install driver with user
>>>> >> > priviledges, but I've heard that using MSI would enable this.
>>>> >> > Anybody care to clarify?
>>>> >> >
>>>> >> > cheers
>
>