WES 7 on t510 - Enable/Disable USB Control while User logged on

[BillyClark]

Hi,

t510 Windows Embedded Standard 7 (WES7 6.1.7601.279)

I am trying to give adminstrators the ability to turn on/off access to USB storage devices without having to log the User account off the device.

I have placed a shortcut to the "HP Local USB Storage Security" applet on the desktop

This, correctly, will not run as the User, so I wish to be able to ctrl-shift-right-click to "Run as Adminstrator"

When "Disable User Security" is set the User can use right-click but when "Enable User Security" is set the right-click does not work

Does anyone know what setting is actually changed by "Enable User Security" that prevents right-click on the desktop?

In Windows XP It used to be: HKCU\Software\Microsoft\Windows\CurrentVersion\PoliciesSaved\Explorer

NoViewContextMenu

Setting 1 to disable right click
Setting 0 to enable right click

But this does not work in Windows 7

Or does anyone have an idea how else to enable/disable USB Storage on the fly.

Thanks in advance.

Billy

[#2]

Can you change the properties of the shortcut (under Advanced) to always Run As Administrator, hence not requiring a right-click?

[BillyClark]

Thanks for the suggestion.

I tried this previously but couldn't get it to work but on your posting I tried a slightly different method:

This doesn't work with a shortcut to the actual Control Panel applet but...

Copied the applet (USBStorCPL.cpl) to another location where the User has Read and Execute permissions

Created a shortcut to USBStorCPL.cpl

Set the shortcut to always "Run as Administrator"

Copied the shortcut to the User Desktop

Hey Presto it working

Thanks for your suggestion.

[BillyClark]

OK new problem...

With the write filer enabled the USB security will not stay set and always reverts to the setting the last time the image was committed.

Any suggestions how to enable/disable USB for the current session with the write filter enabled

[BillyClark]

Fixed: had to change the NoDrives setting for the user to make the USB drives available

[norman1nz]

We want to enable USB drives and Enable User Security Simultaneously.

Seemed to be possible easily / by default in previous TCs.

Is this the only way to enable now - if so can somebody provide a link to / intructions on where to find all settings that need to be changed?

[norman1nz]

OK after about 90mins of testing I've got it working with the following I found on EE:

Note - in Win7 you also need to show protected OS files to open ntuser.dat and you might want to disable auto login of User so ntuser.dat isn't in use after restart

Log in to thin client as administrator
unlock the HP Write Filter (EWF) via Control Panel if it is locked
Launch regedit
select the HKEY_Users key
File -> Load Hive
Browse to the ntuser.dat file at c:\documents and settings\User and open it (name it USER or something)
Expand HKEY_Users\USER\Software\M

icrosoft\Windows\CurrentVersion\Policies\Explorer
Change the NoDrives DWord to a decimal value of 33554439 if you want to block A: B: C: Z: (ramdrive) but allow access to other drive letters (in this case d: probably). (http://www.wisdombay.com/hidedrive/index.php is great for calculating this value for other drive letters)
Change the NoRun DWord to 0
Select the \HKEY_Users\USER key
File - > Unload Hive , yes
Close regedit
Re-lock the EWF (recommended)
Reboot!

[Stan_Gobien]

Thanks Norman!

Your instructions still work for the new t520 thin clients with Windows 8 x64