Solved

Installation of software

Posted on 2004-04-29
29
2,512 Views
Last Modified: 2007-12-19
Hi,

When the user is not a part of the Administrator’s group in Windows 2003 Server and is trying to install an application, it alerts with a message-box saying "The system administrator has set policies to prevent this installation". Is it somehow possible to change the policy or any settings so as to install the application (if the user is not a part of Administrator’s group).

(I guess in XP, any user can install any simple application and in Windows 2000 Server, the same can be installed if we choose a folder other than Program files folder as target-path. Am I correct?)

Thanks,
Mayank.
0
Comment
Question by:mayankeagle
  • 12
  • 8
  • 3
  • +5
29 Comments
 
LVL 12

Expert Comment

by:andrewjb
Comment Utility
Use group editor to alter the installation policy? Or are you asking whether you can do this without Adminsitrator intervention?
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
>> Use group editor to alter the installation policy?

How do we do it? Can it be done without administrative intervention?
0
 
LVL 12

Expert Comment

by:andrewjb
Comment Utility
No - you need an admin.

Start/Run Gpedit.msc
Then it's in there somewher!
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
Ok, but if an administrator sets some installation policies there, then anyone can install a software after that, right?
0
 
LVL 12

Expert Comment

by:andrewjb
Comment Utility
Y
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
As a matter of fact, I'm asking this question for someone else, not for me. But hey~! I can't figure out how to change the policy from Gpedit.msc. Could you help with that?
0
 
LVL 12

Expert Comment

by:andrewjb
Comment Utility
Have U got access to gpedit on the server?
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
Yes, I am an administrator of my system. I will test this thing on my system and will then let the concerned person know.
0
 
LVL 12

Assisted Solution

by:andrewjb
andrewjb earned 25 total points
Comment Utility
There's stuff in Gpedit under:

Computer Configuration / Administrative Templates / Windows Components / Windows Installer.

0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
I tried playing around with it - what I noticed was that a non-administrative user was being able to install some software and he was not being able to install some other applications. Is it that some applications need you to be a system administrator, otherwise they will not install at all, no matter what the group policy is?
0
 
LVL 12

Expert Comment

by:andrewjb
Comment Utility
The installer itself could check whether you're an administrator. (Though the error message you mentioned doesn't sound like this is it.)

I'm not sure I know anything else on this to help further, though... :-(
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
The installer does check it. But it is supposed to install even if a user who is not an administrator has logged-in and is trying to install, right? That is the whole purpose of setting the group-policy.

In some applications like Visio Viewer, it installs with no issues. In some applications like EasyImage, it does not install saying - "You are not an administrator of this system". I'm wondering why it installs for some software and throws out the error-message in others.
0
 
LVL 12

Expert Comment

by:andrewjb
Comment Utility
An installer can check whether you're an admin, and just refuse to install. (e.g. if it needs to write to some registry keys that you wouldn't otherwise be able to modify).

I don't _think_ that the policy options are there to override this. i.e. they don't suddenly let a non-admin modify registry and files that they wouldn't otherwise be able to access. (However, I could be wrong..)

So, there are two possible things that are going on:

1) The administrator doesn't want underlings to install anything, and screw up the system. So group policy editor is used to prevent ANY installs.

2) An installation program needs to modify something that a non-administrator user won't have access to, so you MUST be an admin user to install that specific application....

0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
>> they don't suddenly let a non-admin modify registry and files that they wouldn't otherwise be able to access

Actually, the options are there. There are options like "Install with Elevated Priviledges" and "Let User Control over installer" which allow a non-admin to have elevated privilidges while installing the software.

>> So group policy editor is used to prevent ANY installs

The group policy was set to give elevated priviledges to all users, and to let them install.

I wonder why Visio Viewer installed in the first place.... if nothing was installing, I would have known that something is wrong. But some applications are installing and some are not, though all rights have been given.
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 12

Expert Comment

by:andrewjb
Comment Utility
OK -sorry - told you I wasn't sure!

Don't think I've any more suggestions.... :-)
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
Have posted links to this Q on other TAs. Will wait for some more comments. After that, I'll close it.
0
 
LVL 6

Expert Comment

by:Francois_IT
Comment Utility
here's what i think... we have the same problem here... if the software is licenced, it will ask for admin rights.

but exactly, what are you trying to acheive...
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
Just trying to give permissions to a normal user (who is not part of the administrator's group) to install any software on the system.
0
 
LVL 6

Accepted Solution

by:
Francois_IT earned 25 total points
Comment Utility
just change them to "power user" localy on the stations!
0
 
LVL 2

Assisted Solution

by:chihs
chihs earned 25 total points
Comment Utility
Does the user is a local user of Windwos 2003 server or he/she is just a Windwos 2003 server domain user?
If he/she is a local user of Windows 2003 server, then only need to change the privilege to the administrator then can do the software installation.
If he/she is a domain user, the the privilege will be restrict by the setting on Windows 2003 server, even he/she just want to install software or change system resource on the local pc. Simply login to local PC as an administrator to install the software.


0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
The user is a domain user. So it means it cannot be done, eh? How did it work for Visio Viewer?
0
 
LVL 13

Expert Comment

by:gonzal13
Comment Utility
I just cut and pasted a note from above

1) The administrator doesn't want underlings to install anything, and screw up the system. So group policy editor is used to prevent ANY installs.

2) An installation program needs to modify something that a non-administrator user won't have access to, so you MUST be an admin user to install that specific application....

You can easily be fired if you defeat the restrictions set up by the administrator.. Personally  I would ask permission from the administrator.

gonzal13(joe)
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
I would also cut and paste what I have already said above:

>> "I am an administrator of my system."

.... and I am trying to give permissions to other users to install software on my system.

>> The administrator doesn't want underlings to install anything

I want them to be able to install any software they want to.

>> An installation program needs to modify something that a non-administrator user won't have access to

That is what the "Install with elevated priviledges" and "User Control over installation" options in group-policy are meant for - if I change them, they can have administrative priviledges while installing.

Francois_IT, I don't want to add them to Power Users.
0
 
LVL 13

Expert Comment

by:gonzal13
Comment Utility
Do you have an administrator for the computers? If so, he needs to give you permission. Even if you call yourself the administrator of your pc, you have in your company the administrator for the company. Do not get yourself in trouble by circumventing the system.

I had worked for a large company and for a while everyone that their favorite programs, mostly pirated on their computers. When this was found out, the legal department had a heart attack!

I just to protect yourself and ask permission of your boss.

Do not risk your job over a program, it is not worth it.

gonzal13(Joe)
0
 
LVL 30

Author Comment

by:mayankeagle
Comment Utility
Actually, yes, I have the permission for it. We were trying to figure this out for another project in the company where such a requirement is needed.
0
 

Expert Comment

by:drussotech
Comment Utility
I understand exactly what Mayank wants because I have the same problem.  I am the company administrator.  There is no one who tells me what to do with the network.  It is my responsibility.  We are a small company.  We were on a workgroup only network but now I want to migrate to a domain network.  The reason is not important to the solution. I have built a Windows 2003 server and setup a few users.  I would like to allow "Domain Users" to install software but NOT allow them to change their IP address, rename hard drives or delete files stored on the server...etc.  There is no "Power User" group on domain controllers.  That is for NON-domain controllers.  Setting a local "Power User" on each workstation is not an option nor would this solve my problem. Using the Group Policy Editor I have set the "Disable Windows Installer" to "Never".  I have set the "Enable User Control over Installs" to "Enable" and the "Prohibit User Installs" to "Enable" and "Allow User Installs".  After doing so I log onto a workstation with an account with "Domain User" permissions only but I still can not install programs. I tried to install Acrobat Reader but I get an "Access is Denied" error.  I do not want to add each user to the Administrator group.  If anyone has knowledge on setting permissions to domain users to be able to install software I would be greatly appreciative.  Thank You.
0
 

Expert Comment

by:saidweintraub
Comment Utility
I too am looking for an easier way to do things.
I am the network administrator for a medium sized company and whenever someone needs to install any program that may make changes to the resgistry I have to go there and do it for them.

I have recently been faced with a situation where I installed the Palm OS for a user under the domain administrator account and it works fine, but as soon as I log onto the users account the program does not work correctly.  The program doesnt work correctly on the local users machine either.

finding a way to give the users instant access to install the program and be able to run it fine would be amazing, maybe  I could just remote to their desktop and do a run-as.  hmm
0
 
LVL 13

Expert Comment

by:gonzal13
Comment Utility
When Iwas working asanengineer we would contract out the programming of machinery. The systems integrator as we called him was able after an installation to remotely change the configuration of the program remotely anywhere in the US.

gonzal13(joe)
0
 

Expert Comment

by:michaelk4hp
Comment Utility
hey all,

here is a quick way to get rid of that message.  Go to HKLM\SOFTWARE\Policies\Microsoft\windows\Installer.  This is by default disabled.  Change the value from 2 to 0 and you will be ready to go.

Hope that helps,

Michael Keen, CCA
Citrix Engineer
Hewlett Packard
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

The HP utility "HP Lights-Out Online Configuration Utility for Windows Server 2003/2008" could be of great use when it comes to remotely configure a HP servers ILO WITHOUT rebooting the server. We would only need to create and run scripts using thi…
by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
This video discusses moving either the default database or any database to a new volume.
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now