Installation of software

Hi,

When the user is not a part of the Administrator’s group in Windows 2003 Server and is trying to install an application, it alerts with a message-box saying "The system administrator has set policies to prevent this installation". Is it somehow possible to change the policy or any settings so as to install the application (if the user is not a part of Administrator’s group).

(I guess in XP, any user can install any simple application and in Windows 2000 Server, the same can be installed if we choose a folder other than Program files folder as target-path. Am I correct?)

Thanks,
Mayank.
LVL 30
Mayank SAssociate Director - Product EngineeringAsked:
Who is Participating?
 
Francois_ITConnect With a Mentor Commented:
just change them to "power user" localy on the stations!
0
 
andrewjbCommented:
Use group editor to alter the installation policy? Or are you asking whether you can do this without Adminsitrator intervention?
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
>> Use group editor to alter the installation policy?

How do we do it? Can it be done without administrative intervention?
0
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

 
andrewjbCommented:
No - you need an admin.

Start/Run Gpedit.msc
Then it's in there somewher!
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
Ok, but if an administrator sets some installation policies there, then anyone can install a software after that, right?
0
 
andrewjbCommented:
Y
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
As a matter of fact, I'm asking this question for someone else, not for me. But hey~! I can't figure out how to change the policy from Gpedit.msc. Could you help with that?
0
 
andrewjbCommented:
Have U got access to gpedit on the server?
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
Yes, I am an administrator of my system. I will test this thing on my system and will then let the concerned person know.
0
 
andrewjbConnect With a Mentor Commented:
There's stuff in Gpedit under:

Computer Configuration / Administrative Templates / Windows Components / Windows Installer.

0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
I tried playing around with it - what I noticed was that a non-administrative user was being able to install some software and he was not being able to install some other applications. Is it that some applications need you to be a system administrator, otherwise they will not install at all, no matter what the group policy is?
0
 
andrewjbCommented:
The installer itself could check whether you're an administrator. (Though the error message you mentioned doesn't sound like this is it.)

I'm not sure I know anything else on this to help further, though... :-(
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
The installer does check it. But it is supposed to install even if a user who is not an administrator has logged-in and is trying to install, right? That is the whole purpose of setting the group-policy.

In some applications like Visio Viewer, it installs with no issues. In some applications like EasyImage, it does not install saying - "You are not an administrator of this system". I'm wondering why it installs for some software and throws out the error-message in others.
0
 
andrewjbCommented:
An installer can check whether you're an admin, and just refuse to install. (e.g. if it needs to write to some registry keys that you wouldn't otherwise be able to modify).

I don't _think_ that the policy options are there to override this. i.e. they don't suddenly let a non-admin modify registry and files that they wouldn't otherwise be able to access. (However, I could be wrong..)

So, there are two possible things that are going on:

1) The administrator doesn't want underlings to install anything, and screw up the system. So group policy editor is used to prevent ANY installs.

2) An installation program needs to modify something that a non-administrator user won't have access to, so you MUST be an admin user to install that specific application....

0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
>> they don't suddenly let a non-admin modify registry and files that they wouldn't otherwise be able to access

Actually, the options are there. There are options like "Install with Elevated Priviledges" and "Let User Control over installer" which allow a non-admin to have elevated privilidges while installing the software.

>> So group policy editor is used to prevent ANY installs

The group policy was set to give elevated priviledges to all users, and to let them install.

I wonder why Visio Viewer installed in the first place.... if nothing was installing, I would have known that something is wrong. But some applications are installing and some are not, though all rights have been given.
0
 
andrewjbCommented:
OK -sorry - told you I wasn't sure!

Don't think I've any more suggestions.... :-)
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
Have posted links to this Q on other TAs. Will wait for some more comments. After that, I'll close it.
0
 
Francois_ITCommented:
here's what i think... we have the same problem here... if the software is licenced, it will ask for admin rights.

but exactly, what are you trying to acheive...
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
Just trying to give permissions to a normal user (who is not part of the administrator's group) to install any software on the system.
0
 
chihsConnect With a Mentor Commented:
Does the user is a local user of Windwos 2003 server or he/she is just a Windwos 2003 server domain user?
If he/she is a local user of Windows 2003 server, then only need to change the privilege to the administrator then can do the software installation.
If he/she is a domain user, the the privilege will be restrict by the setting on Windows 2003 server, even he/she just want to install software or change system resource on the local pc. Simply login to local PC as an administrator to install the software.


0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
The user is a domain user. So it means it cannot be done, eh? How did it work for Visio Viewer?
0
 
gonzal13RetiredCommented:
I just cut and pasted a note from above

1) The administrator doesn't want underlings to install anything, and screw up the system. So group policy editor is used to prevent ANY installs.

2) An installation program needs to modify something that a non-administrator user won't have access to, so you MUST be an admin user to install that specific application....

You can easily be fired if you defeat the restrictions set up by the administrator.. Personally  I would ask permission from the administrator.

gonzal13(joe)
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
I would also cut and paste what I have already said above:

>> "I am an administrator of my system."

.... and I am trying to give permissions to other users to install software on my system.

>> The administrator doesn't want underlings to install anything

I want them to be able to install any software they want to.

>> An installation program needs to modify something that a non-administrator user won't have access to

That is what the "Install with elevated priviledges" and "User Control over installation" options in group-policy are meant for - if I change them, they can have administrative priviledges while installing.

Francois_IT, I don't want to add them to Power Users.
0
 
gonzal13RetiredCommented:
Do you have an administrator for the computers? If so, he needs to give you permission. Even if you call yourself the administrator of your pc, you have in your company the administrator for the company. Do not get yourself in trouble by circumventing the system.

I had worked for a large company and for a while everyone that their favorite programs, mostly pirated on their computers. When this was found out, the legal department had a heart attack!

I just to protect yourself and ask permission of your boss.

Do not risk your job over a program, it is not worth it.

gonzal13(Joe)
0
 
Mayank SAssociate Director - Product EngineeringAuthor Commented:
Actually, yes, I have the permission for it. We were trying to figure this out for another project in the company where such a requirement is needed.
0
 
drussotechCommented:
I understand exactly what Mayank wants because I have the same problem.  I am the company administrator.  There is no one who tells me what to do with the network.  It is my responsibility.  We are a small company.  We were on a workgroup only network but now I want to migrate to a domain network.  The reason is not important to the solution. I have built a Windows 2003 server and setup a few users.  I would like to allow "Domain Users" to install software but NOT allow them to change their IP address, rename hard drives or delete files stored on the server...etc.  There is no "Power User" group on domain controllers.  That is for NON-domain controllers.  Setting a local "Power User" on each workstation is not an option nor would this solve my problem. Using the Group Policy Editor I have set the "Disable Windows Installer" to "Never".  I have set the "Enable User Control over Installs" to "Enable" and the "Prohibit User Installs" to "Enable" and "Allow User Installs".  After doing so I log onto a workstation with an account with "Domain User" permissions only but I still can not install programs. I tried to install Acrobat Reader but I get an "Access is Denied" error.  I do not want to add each user to the Administrator group.  If anyone has knowledge on setting permissions to domain users to be able to install software I would be greatly appreciative.  Thank You.
0
 
saidweintraubCommented:
I too am looking for an easier way to do things.
I am the network administrator for a medium sized company and whenever someone needs to install any program that may make changes to the resgistry I have to go there and do it for them.

I have recently been faced with a situation where I installed the Palm OS for a user under the domain administrator account and it works fine, but as soon as I log onto the users account the program does not work correctly.  The program doesnt work correctly on the local users machine either.

finding a way to give the users instant access to install the program and be able to run it fine would be amazing, maybe  I could just remote to their desktop and do a run-as.  hmm
0
 
gonzal13RetiredCommented:
When Iwas working asanengineer we would contract out the programming of machinery. The systems integrator as we called him was able after an installation to remotely change the configuration of the program remotely anywhere in the US.

gonzal13(joe)
0
 
michaelk4hpCommented:
hey all,

here is a quick way to get rid of that message.  Go to HKLM\SOFTWARE\Policies\Microsoft\windows\Installer.  This is by default disabled.  Change the value from 2 to 0 and you will be ready to go.

Hope that helps,

Michael Keen, CCA
Citrix Engineer
Hewlett Packard
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.