SafeStick seems to require Admin Rights / Stuck on Initialisation

02 Sep 2010

Support Center » Knowledgebase » SafeStick seems to require Admin Rights / Stuck on Initialisation

	SafeStick seems to require Admin Rights / Stuck on Initialisation

Solution SafeStick does not need admin rights to run successfully, but there are occasions where an issue with the environment "appears" to make SafeStick need "Admin Rights" in order to function correctly.

If your SafeStick does seem to require admin rights, firstly please make sure you are running the latest SafeStick firmware - AT LEAST v4.02 available from this website or from http://www.softek.co.uk

If you are running latest firmware, and still have issues, please see below for a few other suggestions. If all these fail please log a ticket with Softek giving full environment details, and a copy of your setupapi.log file and SafeStick logging (see KB on how to do this) if possible.

Symptom:

Your machine(s) have been logged on as "normal" non-privileged "Domain Users" and when you plug the SafeStick in you are prompted by Windows to enter Administrator credentials. The dialog box says "You must be in the Administrators Group" or the Stick does not initialise at all.

For your information all of the three issues listed below have been replicated using a standard unencrypted Kingston and SANdisk USB stick's - in other words these issues have proven to be not solely SafeStick specific.

1. UNSIGNED USB DRIVERS

We have found (as an example) that Dell ships pre-installed Roxio software with drivers not digitally signed. Unsigned drivers (when running as a non-admin) stall the initialisation of USB sticks as well as SafeSticks.

For a user WITH admin rights it is slightly different - unsigned driver errors are simply ignored and carry on as normal.

UN-SIGNED DRIVER RESOLUTION

You can use Windows own "File Signature Verification" to check which drivers are signed or not, and you can then visit Microsoft or the Vendor to obtain properly signed ones.

Go to Start -> Run, type sigverif and click OK.

Click Advanced button and select "Look for other files that are not digitally signed".

Make sure the file type is *.* and the location to look for is C:\Windows.

Also, check "Include subfolders" check box.

Click OK and it will take a few minutes to scan.

Normally the amount of unsigned files displayed in Signature Verification Results should be less than 50

Repairing Windows can fix the problem if it is a lot of unsigned drivers.

Otherwise, some of these may help:

a) Make sure Cryptographic Services is running.
Go to Start -> Run, type services.msc and click OK. Look for Cryptographic Services and make sure that the status is "Started" and Startup Type is "Automatic".

b) Ignore warnings to install drivers that has not passed Windows Logo testing.
- Right click My Computer, select Properties. In System Properties, go to Hardware tab and click Driver Signing button. Select "Ignore - Install the software anyway and don't ask for my approval"

1. Corrupted drivers (usbstor.inf, usbstor.pnf, usbstor.sys)
Solution: Replace usbstor.inf and usbstor.pnf in C:\Windows\INF\ with a good one. and usbstor.sys in C:\Windows\system32\drivers\ with a good one.

A lot of information of this subject of non-signed drivers has been gleaned from here:

http://www.raymond.cc/blog/archives/2007/11/29/windows-requires-administrator-rights-to-install-usb-flash-drives/

Some further information:

http://support.microsoft.com/kb/822798

2. CRYPTOGRAPHIC SERVICE CORRUPUPT / NON-FUNCTIONING

The dlls associated with Cryptographic Services are corrupt or non-usable and need to be re-registered. Follows this procedure from Microsoft http://support.microsoft.com/kb/822798

3. MCAFEE SAFEBOOT

3.1 McAfee SafeBoot PortControl service is installed but disabled, causing the Windows installer to "fall over" and generate the error. To check this, open setupapi.log in Notepad from C:\WINDOWS\

Look at the bottom of the log and look for something like "SbPrtCtrl filter service - Device could not be installed because the service is disabled or does not have sufficient rights."

Solution - Set the SafeBoot Port Control service to be started on Bootup. Try again.

3.2 McAfee SafeBoot PortControl service is installed but the driver for SbPrtCtrl.sys is not digitally signed, causing the installation of SafeStick VIA this driver failing. To check this, open setupapi.log in Notepad from C:\WINDOWS\

Look at the bottom of the log and look for something like "Driver is not signed, subject missing from the subject line"

Proof of Concept - Uninstall SafeBoot Port Control service, reboot machine, log back in as Domain User, plug SafeStick back in. To PROVE that SafeStick has installed as a normal user, Open Windows Explorer, go to C:\WINDOWS\system32\ - Go to cmd.exe Shift+Right-click it and "Run as..." Administrator

Now run devmgmt.msc so that "Device Manager" runs as the local administrator. Expand the USB Controller devices and look for "USB Mass Storage Device" (When SafeStick is plugged in) Right-click Properties, Details Tab:

Look for USB\VID_1DFA&PID_EE27\07xxxxxxCxxxxxxxxx
or
Look for USB\VID_1DFA&PID_E327\07xxxxxxCxxxxxxxxx

If you see "EE27" or "E327" then you know that SafeStick has been installed as a normal user. If it shows "1E27" or "3327" then the device has been installed as an Administrator.

Solution 1 - Relax local user permissions so that devices can be installed without needing any admin rights.

Solution 2 - Approach McAfee to get hold of Digitally Signed Drivers.

Article Details

Article ID:

535

Created On:

30 Mar 2009 10:43 AM