Installation of software

Use group editor to alter the installation policy? Or are you asking whether you can do this without Adminsitrator intervention?

>> Use group editor to alter the installation policy?

How do we do it? Can it be done without administrative intervention?

No - you need an admin.

Start/Run Gpedit.msc
Then it's in there somewher!

Ok, but if an administrator sets some installation policies there, then anyone can install a software after that, right?

Y

As a matter of fact, I'm asking this question for someone else, not for me. But hey~! I can't figure out how to change the policy from Gpedit.msc. Could you help with that?

Have U got access to gpedit on the server?

Yes, I am an administrator of my system. I will test this thing on my system and will then let the concerned person know.

I tried playing around with it - what I noticed was that a non-administrative user was being able to install some software and he was not being able to install some other applications. Is it that some applications need you to be a system administrator, otherwise they will not install at all, no matter what the group policy is?

The installer itself could check whether you're an administrator. (Though the error message you mentioned doesn't sound like this is it.)

I'm not sure I know anything else on this to help further, though... :-(

The installer does check it. But it is supposed to install even if a user who is not an administrator has logged-in and is trying to install, right? That is the whole purpose of setting the group-policy.

In some applications like Visio Viewer, it installs with no issues. In some applications like EasyImage, it does not install saying - "You are not an administrator of this system". I'm wondering why it installs for some software and throws out the error-message in others.

An installer can check whether you're an admin, and just refuse to install. (e.g. if it needs to write to some registry keys that you wouldn't otherwise be able to modify).

I don't _think_ that the policy options are there to override this. i.e. they don't suddenly let a non-admin modify registry and files that they wouldn't otherwise be able to access. (However, I could be wrong..)

So, there are two possible things that are going on:

1) The administrator doesn't want underlings to install anything, and screw up the system. So group policy editor is used to prevent ANY installs.

2) An installation program needs to modify something that a non-administrator user won't have access to, so you MUST be an admin user to install that specific application....

>> they don't suddenly let a non-admin modify registry and files that they wouldn't otherwise be able to access

Actually, the options are there. There are options like "Install with Elevated Priviledges" and "Let User Control over installer" which allow a non-admin to have elevated privilidges while installing the software.

>> So group policy editor is used to prevent ANY installs

The group policy was set to give elevated priviledges to all users, and to let them install.

I wonder why Visio Viewer installed in the first place.... if nothing was installing, I would have known that something is wrong. But some applications are installing and some are not, though all rights have been given.

OK -sorry - told you I wasn't sure!

Don't think I've any more suggestions.... :-)

Have posted links to this Q on other TAs. Will wait for some more comments. After that, I'll close it.

here's what i think... we have the same problem here... if the software is licenced, it will ask for admin rights.

but exactly, what are you trying to acheive...

Just trying to give permissions to a normal user (who is not part of the administrator's group) to install any software on the system.

The user is a domain user. So it means it cannot be done, eh? How did it work for Visio Viewer?

I just cut and pasted a note from above

1) The administrator doesn't want underlings to install anything, and screw up the system. So group policy editor is used to prevent ANY installs.

2) An installation program needs to modify something that a non-administrator user won't have access to, so you MUST be an admin user to install that specific application....

You can easily be fired if you defeat the restrictions set up by the administrator.. Personally  I would ask permission from the administrator.

gonzal13(joe)

I would also cut and paste what I have already said above:

>> "I am an administrator of my system."

.... and I am trying to give permissions to other users to install software on my system.

>> The administrator doesn't want underlings to install anything

I want them to be able to install any software they want to.

>> An installation program needs to modify something that a non-administrator user won't have access to

That is what the "Install with elevated priviledges" and "User Control over installation" options in group-policy are meant for - if I change them, they can have administrative priviledges while installing.

Francois_IT, I don't want to add them to Power Users.

Do you have an administrator for the computers? If so, he needs to give you permission. Even if you call yourself the administrator of your pc, you have in your company the administrator for the company. Do not get yourself in trouble by circumventing the system.

I had worked for a large company and for a while everyone that their favorite programs, mostly pirated on their computers. When this was found out, the legal department had a heart attack!

I just to protect yourself and ask permission of your boss.

Do not risk your job over a program, it is not worth it.

gonzal13(Joe)

Actually, yes, I have the permission for it. We were trying to figure this out for another project in the company where such a requirement is needed.

I understand exactly what Mayank wants because I have the same problem.  I am the company administrator.  There is no one who tells me what to do with the network.  It is my responsibility.  We are a small company.  We were on a workgroup only network but now I want to migrate to a domain network.  The reason is not important to the solution. I have built a Windows 2003 server and setup a few users.  I would like to allow "Domain Users" to install software but NOT allow them to change their IP address, rename hard drives or delete files stored on the server...etc.  There is no "Power User" group on domain controllers.  That is for NON-domain controllers.  Setting a local "Power User" on each workstation is not an option nor would this solve my problem. Using the Group Policy Editor I have set the "Disable Windows Installer" to "Never".  I have set the "Enable User Control over Installs" to "Enable" and the "Prohibit User Installs" to "Enable" and "Allow User Installs".  After doing so I log onto a workstation with an account with "Domain User" permissions only but I still can not install programs. I tried to install Acrobat Reader but I get an "Access is Denied" error.  I do not want to add each user to the Administrator group.  If anyone has knowledge on setting permissions to domain users to be able to install software I would be greatly appreciative.  Thank You.

I too am looking for an easier way to do things.
I am the network administrator for a medium sized company and whenever someone needs to install any program that may make changes to the resgistry I have to go there and do it for them.

I have recently been faced with a situation where I installed the Palm OS for a user under the domain administrator account and it works fine, but as soon as I log onto the users account the program does not work correctly.  The program doesnt work correctly on the local users machine either.

finding a way to give the users instant access to install the program and be able to run it fine would be amazing, maybe  I could just remote to their desktop and do a run-as.  hmm

When Iwas working asanengineer we would contract out the programming of machinery. The systems integrator as we called him was able after an installation to remotely change the configuration of the program remotely anywhere in the US.

gonzal13(joe)

hey all,

here is a quick way to get rid of that message.  Go to HKLM\SOFTWARE\Policies\Microsoft\windows\Installer.  This is by default disabled.  Change the value from 2 to 0 and you will be ready to go.

Hope that helps,

Michael Keen, CCA
Citrix Engineer
Hewlett Packard