Using Windows Server 2003 in a Managed Environment
Driver Protection
On This PageBenefits and Purposes of Driver ProtectionThe Driver Protection feature in the Microsoft Windows Server 2003 family prevents the operating system from loading drivers that are known to cause stability problems (for example, preventing the operating system from booting). These drivers are listed in a Driver Protection List database included with the operating system. Driver Protection checks this database during operating system upgrades and at run time. These checks are performed to determine whether to load a driver under one of the operating systems in the Windows Server 2003 family. Driver Protection also displays up-to-date content about these driver problems in Help and Support Center, including links to sites where users can find a solution. Driver Protection relies on Windows Update and Dynamic Update to update the database files so that users are presented with the most current information available on protected drivers. Users cannot directly disable Driver Protection. Drivers are added to the Driver Protection List based on feedback from end users about problems that can be reproduced and confirmed at Microsoft. The main reasons a driver is added to this list are:
Decisions to add drivers to this list are made in consultation with the vendors who produce and distribute these drivers. Microsoft engages and informs these vendors before adding a driver to the Driver Protection List. A listing of the content in the Driver Protection List for the Windows Server 2003 family is available as part of a white paper that provides additional information about Driver Protection on the Windows Platform Development Web site at: http://www.microsoft.com/whdc/driver/security/drv_protect.mspx This section of the white paper explains how to control Driver Protection in a managed environment. Overview: Using Driver Protection in a Managed EnvironmentUsers have no direct control over whether to download files required by Driver Protection for updating the Driver Protection List. In a managed environment it is unlikely that users will be allowed to send and receive driver information freely; this function would normally be controlled in some fashion by the IT department. You can indirectly block Driver Protection from downloading files by disabling Windows Update or by avoiding the use of Dynamic Update. Details on the methods and procedures for controlling Driver Protection are described in the following subsections. How Driver Protection Communicates with Sites on the InternetThis subsection summarizes the communication process:
Controlling Driver Protection to Limit the Flow of Information to and from the InternetYou cannot disable Driver Protection directly. To block the downloading of updates for the Driver Protection database files, you can disable the settings for Windows Update and (during setup) avoid the use of Dynamic Update. (Of course you can also block downloading by preventing access to the Internet, or by blocking HTTP over port 80.) How Controlling Driver Protection can Affect Users and ApplicationsDriver Protection blocks known problem drivers from loading, but it does not block any associated applications that depend on those drivers. Therefore, the behavior of applications that depend on drivers that are blocked varies depending on the implementation of the application. Some applications, such as antivirus programs, install drivers in order to provide their core functionality. For these applications, Driver Protection may cause the application not to work at all. Other applications, such as CD-burning programs, use drivers for portions of their feature set. For these applications, only those features that do not depend on the driver may work. If you decide to disable Driver Protection from pulling down updated versions of the Driver Protection List database, drivers that affect system stability will continue to be blocked. The operating system, however, will use the version of the Driver Protection List database that comes with the operating system to identify the drivers to block, instead of a more accurate, up-to-date version of the list. Alternate Methods for Controlling Driver ProtectionA more drastic measure to take would be to disable the Upload Manager service (uploadmgr) that manages synchronous and asynchronous file transfers between clients and servers on the network. Disabling this service will block the upload of the anonymous hardware profile data (although users will still be able to complete the Hardware Wizard). The operating system will, however, use the version of the Driver Protection List database that comes with the operating system to identify the drivers to block, instead of a more accurate, up-to-date version of the list. The following subsection gives the procedure for this method. Procedure for Disabling How Driver Protection Communicates over the InternetYou cannot disable Driver Protection directly but can do so indirectly by controlling its ability to connect to the Internet by disabling Windows Update or avoiding the use of Dynamic Update. See the sections in this white paper titled "Windows Update and Automatic Updates" and "Dynamic Update," for more information about these methods. As mentioned in the previous subsection, a more drastic method for disabling Driver Protection is to disable the Upload Manager service. To Disable how Driver Protection Communicates over the Internet by Disabling the Upload Manager service
Important: If this service is disabled, any services that explicitly depend on it will fail to start.
|
In This Article
|
